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© Electronic monetary system. 



© An improved monetary system using electronic media to exchange economic value securely and rehabty. 
^eTnven'on provides a'comp.ete monetary system having electronic money that ,s -terchangeab.e wrfh 
conventional paper money comprising (1) issuing banks or financial institutions that are coupled to a money 
operator device for generating and issuing to subscribing customers electrons currency backed by demand 
r P oS "electronic credit authorizations; (2) correspondent banks that accept and distribute the electronic 
money (3) a plurality of transaction devices that are used by subscribers for stonng electrons money, for 
performing money transactions with the on - line systems of the participating banks or for exchanging electronic 
money with other like transaction devices; (4) automated teller devices, associated with the .ssuing and 
correspondent banks, for process handling and interfacing the transaction devices to the issuing and cor- 
respondent banks and for interfacing between the issuing and correspondent banks themselves; and (5) a 
clearing bank for balancing the electronic money accounts of the different issu.ng banks (6). 
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Backgr ound of the Invention 

The present invention relates to an electronic monetary system for implementing electronic money 
payments as an alternative medium of economic exchange to cash, checks, credit and debit cards, and 

5 electronics fund transfer. The Electronic - Monetary System is a hybrid of currency, check, card payment 
systems and electronic funds transfer systems, possessing many of the benefits of these systems with few 
of their limitations. The system utilizes electronic representations of money which are designed to be 
universally accepted and exchanged as economic value by subscribers of the monetary system. 

Today approximately 350 billion coin and currency transactions occur between individuals and 

10 institutions every year. The extensive use of coin and currency transactions has limited the automation o 
individual transactions such as purchases, fares, and bank account deposits and withdrawals. Individual 
cash transactions are burdened by the need of having the correct amount or providing change therefor. 
Furthermore, the handling and managing of paper cash and coins is inconvenient, costly and time 
consuming for both individuals and financial institutions alike. 

,s Although checks may be written for any specific amount up to the amount available in the account 
checks have very limited transferability and must be supplied from a physical inventory. Paper -based 
checking systems do not offer sufficient relief from the limitations of cash transactions, sharing many of the 
inconveniences of handling currency while adding the inherent delays associated with processing checks. 
To this end, economic exchange has striven for greater convenience at a lower cost, wh.le also seek.ng 

20 improved security. . . . 

Automation has achieved some of these qualities for large transactions through computerized electronic 
funds transfer ("EFT") systems. Electronic funds transfer is essentially a process of value exchange 
achieved through the banking system's centralized computer transactions. EFT services are a transfer of 
payments utilizing electronic "checks," which are used primarily by large commercial organizations 

The Automated Clearing House (ACH) and point of sale (POS) systems are examples of electronic 
funds transfer systems that have become used by retail and commercial organizations on a substantia 
basis in recent years. However, the payments made through these types of EFT systems are limited in that 
they cannot be performed outside of the banking system. Moreover. ACH transactions usually cannot be 
performed during off business hours. 

Home banking bill payment services are examples of an electronic funds transfer system used by 
individuals to make payments. Currently, home banking initiatives have found few customers. Of the banks 
that have offered services for payments, account transfers and information over the telephone lines using 
personal computers, less than one percent of the bank's customers are using the service. One reason that 
home banking has not been a successful product because the customer cannot deposit and withdraw 
35 money as needed in this type of system. 

Current EFT systems, credit cards, or debit cards, which are used with an on-line system to transfer 
money between accounts, such as between the account of a merchant and that of a customer, cannot 
satisfy the need for an automated transaction system that provides for the transfer of universally accepted 
economic value outside of the banking system. , 

To implement an automated, yet more convenient transaction system that does not require the banking 
system to intermediate the transfer, and that can dispense some form of economic value, there has been a 
trend towards off-line electronic funds transfer. For example, numerous ideas have been proposed for 
some form of "electronic money" that can be used in cashless payment transactions as alternatives to the 
traditional currency and check types of payment systems. See U.S. Patent No. 4,977,595, entitled 
"METHOD AND APPARATUS FOR IMPLEMENTING ELECTRONIC CASH, and U.S. Patent No. 4,305.059. 
entitled "MODULAR FUNDS TRANSFER SYSTEM." 

The more well known techniques include magnetic stripe cards purchased for a given amount and from 
which a prepaid valve can be deducted for specific purposes. Upon exhaustion of the economic valve, the 
cards are thrown away. Other examples include memory cards or so called smart cards which are capable 
of repetitively storing information representing value that is likewise deducted for specific purposes. 

However these proposed systems suffer from a failure to recognize fully the significance of bank 
deposits as money, and their necessity to back any form of universally accepted monetary representations 
that may be issued. In the systems disclosed thus far, representations of economic value, whether 
electronic or paper, are issued without the backing of equal valued liabilities as the counterpart to their 
55 assets 

None of the paperless payment systems that have been proposed so far are comprehensive enough so 
as to implement a multipurpose electronic monetary system that includes not only the automated devices 
that allow subscribers to transfer electronic funds or money between them without any intermediating 
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system but that also encompasses and includes an entire banking system for generator* the vaue 
^presented by the electronic money and for clearing and settling the electronic money accounts of the 
banks and financial institutions involved to maintain a monetary balance within the system. 

Thus specifically, there is a need for a system that allows common payor to payee transacts ; without 
the intermediation of the banking system, and that gives control of the payment process to the - 
Furthermore, a need exists for providing a system of economic exchange that can be used by large 
orgTrLtions for commercial payments of any size, that does not have the lim.tations of the current EFT 

^Accordingly it is an object of the present invention to overcome the aforesaid shortfalls by providing a 
complete electronic monetary system which utilizes electronic money that is interchangeable with trad.t.onal 

cash and is universally accepted. «i;, ir ,„ 
The present invention provides an electronic monetary system for providing transactions utilizing 
electronic representations of currency backed by demand deposits in a bank comprising: .. t . 

means for generating said electronic representations of currency, teller means for issuing and distributing 
said electronic representations of currency; transacting means for storing, and for transferring said 
electronic representations of currency between other transacting means and between said transacting 
means and said teller means. *r,t„„ 
The present invention also provides an electronic monetary system for providing transactions util.z.ng 
electronic representations of credit authorizations comprising: 

means for generating said electronic representations of credit; teller means for .ssuing and d.stnbu mg said 
electronic representations of credit; transaction means for storing, and for transferring sa.d electronic 
representations of credit between other transacting means and between said transacting means and sa.d 

^^urtheTthe present invention provides for a method of using electronic representations of currency or 
electronicrepresentations of credit provided by at least one financial facility having a means for generating 
said electronic representations, and atelier means for issuing and accepting said electronic representations 
and serving subscribers of said facility, comprising the steps of: generating said electronic representations 
of currency backed by demand deposits or generating said electronic representations of credit authonza 
tions- issuing to said subscribers and accepting from said subscribers electronic representations of currency 
or credit wherein the issuance and acceptance is performed by said teller means at said financial facility; 
and providing said subscribers with a transacting means for accepting said issued electronic representa- 
tions of currency or credit, and for transferring said electronic representations of currency or cred.t to both 
other subscribers having said transacting means, and to said teller means. 

The present invention provides a method of securely transferring economic value including currency 
and credit among subscribers, among financial institutions, and between subscribers and financial institu- 
tions The system provided is a paperless system whereby transactions can be carried out in both an on - 
line and an off-line mode between subscribers. The system reduces the cost of central electronic funds 
transfer systems by off loading much of the payments to off-line devices. The system provides for 
inexpensive electronic transfers to reduce an institution's cost of managing paper cash, checks and co.ns^ 
Further the invention provides a user friendly electronic payment system that may be used reliably and 
securely for real time transfers of money between members of the general public, between members of the 
general public and commercial organizations, and between commercial organizations. The system may be 
integrated with a wide variety of data processing and data communication systems including currently 
available home banking services, Further, the system can be utilized with electronic money in the form of 
multiple currencies and in transactions of virtually any size denomination. Further the medium of economic 
exchange provided is fungible, easily transferable, undeniably redeemable, and secure from reuse, du - 
plication, and counterfeiting. 

The foregoing features and advantages of the invention are illustrative of those which can be achieved 
by the present invention and are not intended to be exhaustive or limiting of the possible advantages which 
can be realized. Thus, these and other features and advantages of the invention will be apparent from the 
description herein or can be learned from practicing the invention, both as embodied herein or as modified 
in view of any variations which may be apparent to those skilled in the art. 

Summary of Exemplary Embodiment 

To achieve the foregoing, and other objects, the methods and apparatus of the present invention 
employ a preferred embodiment in the form of an electronic - monetary system having (1) banks or financial 
institutions that are coupled to a money generator device for generating and issuing to subscribing 
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customers electronic money including electronic currency backed by demand 

authorizations- (2) correspondent banks that accept and distribute the electronic money, (3) a plurality -of 
I^^Mes that are used by subscribers for storing electronic money, for performing money 
SSSS.^Ttt» on - line systems of the participating banks or for exchanging j eiectronic money with 
other like transaction devices in off-line transactions; (4) teller dev.ces, associated with the issuing and 
correspondenrbanks, for process handling and interfacing the transaction devices to the issuing and 
TreSonden banks and for interfacing between the issuing and correspondent 

clearing bank for ba.ancing the electronic money accounts of the different f^^^J data 
communications network for providing communications services to all components of the system, and (7) a 
sTuTy arrangement for maintaining the integrity of the system, and for detecting counterfe.fng and 

^T^rlf^ S embodiment the functions of the money generating devices, the transaction device, 
and the teller devices will be performed by a combination of tamper -proof computer hardware and 
appli ation software modu.es that may be networked together. Information is transmitted .n an encryp ted 
form to provide security from unauthorized inspection. The electron.c money is transmitted with digital 
sianatures to provide authentication, and security from modification or counterfeiting. 

9 The electronic money exchanged by these devices may be an electronic represent^ of currency or 
credit. An important aspect of the electronic currency is that it is the equ.valent of bank ^ notes and is 
interchangeable with conventional paper money through claims on deposits in an .ssumg bank, but can be 
withdrawn or deposited both at an issuing bank and at a correspondent bank. However, only the .ssu.ng 
banks can generate the electronic currency, and will be liable for its redemption. mnnptarv 
The issuing banks later utilize inter -bank clearing and settling processes to maintain the monetary 
balance in the banking system, as is currently practiced by today's banking industry. rpdeemable 
The electronic money representations are fungible, universally accepted, and under.* V J^TfJ 
from the issuing banks, i.e.. they have the characteristics of money transactions. To preserve the integrity of 
^eSSnXSSrtary- system each exchange of electronic money includes, along with other .nformation 
da^ iSXng the monetary unit of the credit or currency, (i.e., dollars, yen, etc.) the amount by unit of 
cSit or currency, and the bank issuing the electronic credit or currency, and several d.g.ta. signatures. 

30 Summary of The Invention 

in accordance with these and other objects of the invention, a brief summary of the present invention is 
presented. Some simplifications and omissions may be made in the following summary ^ rim* ms intended 
to hiqhliqht and introduce some aspects of the present invention, but not to limit its scope Detailed 
desertions of a preferred exemplary embodiment adequate to allow those of ordinary sk,ll ,n the art to 
make and use the inventive concepts will follow in later sections. 

Lc^rd ng o a broad aspect of the invention, an e.ectronic monetary system provides for tractions 
utilizing electronic money including e.ectronic currency backed by demand deposits in a bark n heu 
cash transactions, and electronic credit authorizations. The invention comprises a ""^^SonE 
generating the electronic money; a money module for issuing, distributing and accepting *e electronu: 
money; and a money module for accepting, storing, and transferring the electron.c money between other 
accepting money modules and between the accepting money module and the issuing m °ney module. 

According to a further aspect of the invention, an electronic monetary system ,s provided for 
implementing and maintaining electronic money which includes electronic currency that .s interchangeable 
with conventional money through claims on deposits in a bank, and electron.c credit authorizations. 

The system includes a plurality of issuing banks; a genorator for creating electron.c money to Her 
modules coupled to the generator module, for performing teller transactions and for interfacing with other 
teller modules, such transactions including the accepting and the distributing of the e ectron.c money; a 
security system for providing the overall integrity of the electronic monetary system; a clearing and setti ng 
process for ba.ancing the e.ectronic money accounts of the separate issu.ng banks and for ^cleannfi , the 
electronic money issued by the issuing banks; and a p.ura.ity of transaction modules ^ owned bV au*or.zed 
users, for transferring the electronic money between the transaction modules and between the transaction 
modules and the teller modules. 

in accordance with another aspect of the invention, the functions of the generator modules, the 
transaction modules, and the teller modules will be performed by a combination of tamper -proof computer 
hardware and application software that may be networked together. 

The electronic money exchanged by these modules, which may be an electron.c representation of 
currency backed by demand deposit accounts at the issuing bank or credit authorizations, may be 
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%5Z and the Sd a" is of e.ectronic money to be renewed periodically- Offendmg modules or 
counteiit electronic money can be removed from circulation as soon as they are discovered. 
RriPfiu a Drocess in accordance with the invention comprises the steps ot 
(iTpldinTa generating modu.e to generate electronic representations of econom.c value backed by 

accept the generated e.ectronic representations of economic value and to 

^^^^^:^^^e for accepting, storing and transferring the 
lltronic presentations of economic exchange to other authorized users having the transact^ module 

representations of economic value to other authorized users 

^^^^^^^o representations ot economic va.ue in a 
secure manner between the generating module, the teller modu.e and the transacting module. 

Brief D escription of the Drawings 

Other objects and advantages of the present invention will become more apparent by the following 
description with reference to accompanying drawings, in which: 
Fiaure 1 is a diagram illustrating general aspects of the invention; 

Figure 2 a schematic diagram of the operative arrangement of the components, accord.ng to the 

Rg e ure i0 3 is a perspective diagram of several embodiments of external systems that may house a money 

module, according to the invention. . 

Figure 4 is a block form diagram of a transaction money module, according to the invention. 

Figure 5 is a block form diagram of a Teller money module, according to the mvention 

Figure 6 is a block form diagram of a Money Generator module, according to the invent.on. 

Figure 7 is a block diagram of the network arrangement, according to the invention. 

Figure 8 is a block diagram of a Network Sever, according to the invention. 

Fiqure 9 is a flow diagram of the security system, according to the invention. 

Fiqure 10 is a block form diagram of a security server, according to the mvent.on. 

Figures 1 1 - 24 are flow diagrams of accounting examples, according to the invention. 

Figure 25 a flow diagram of the Transaction Reconciliation System, according to the mvention. 

Figure 26 is a flow diagram of the Clearing System, according to the mvention^ . ntinn 

Fiqure 27 is a flow diagram of the Money Issued Reconciliation System, accord.ng to the .nvenfton. 

Figures 28 - 50A are flow charts of transaction examples, according to the invention. 

Di sclosure of the Preferred Embodiment of the Invention 

The present invention contemplates an improved monetary system using electronic media to ' securely 
and reliably exchange economic value. The system can be implemented by .ntegratmg novel data 
pmcesslng systems with other procedures which can be implemented with the current worldwide bankmg 

^^roughout this description, "electronic money" may also be referred to by the abbreviatio n "E-M/" 
Additionally, the term "bank" is used hereinafter to indicate any banking, financial institution or the l.ke 

Whi ^e°^ numerals refer to like component, there is disclosed in 

Figure 1 in 9 b"ock Torm. broad aspects of the preferred embodiment. In Fig. 1. the genera, relate riship 
Song the features of the system is shown. The system includes Issuing Banks 1 each having , a Teller 
money modu.e 5 and a Money Generator module 6; Correspondent Banks 2 each having a Teller ^money 
modute 5; an e.ectronic money Clearing Bank 3; a Certification Agency 28 and a plural.ty of Transact™ 
monev modules 4 owned by subscribers of the system. 
, BecTnic notes 11, the media for transferring e.ectronic money, are generated by the Money Generator 
module 6 for an .ssuing Bank 1. These notes 11 are then transferred by a Teller money . module 5 to a 
subscriber utilizing a Transaction money module 4. Electronic notes 11 may be representations^ currency 
or credit authorizations. For security reasons, all e.ectronic notes 11 will exp.re after a preset tme penod. 
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Once expired, the notes 11 must be redeemed at a participating bank for updated ones before they can be 

tranS in r |ssuing Bank 1 generates and distributes the electronic notes 11, and is liable for their redemption. 
An Issuing Bank 1 performs deposits, withdrawals, payments to loans and inquiries for other money 

^Correspondent Bank 2 is a participating bank which distributes electronic money through accounts it 
maintains at Issuing Banks 1. but does not generate any electronic money, and is not liable for its 
redemption. Because it cannot generate any electronic money, the Correspondent Bank 2 ,n the preferred 
embodiment must make real-time requests of electronic money from an account it maintains at an Issuing 
Bank 1 whenever a subscriber wishes to withdraw electronic money at a Correspondent Bank 2. 

Conversely, a Correspondent Bank 2 deposits all electronic money deposited by subscribers, to the 
accounts the Correspondent Bank 2 holds at Issuing Banks 1. These accounts will be described hereinafter 
A Correspondent Bank 2, like an Issuing Bank 1, will perform deposits withdrawals, payments to loans and 

ban Notably e an Issuing Bank 1 may also be a Correspondent Bank 2 for the monetary units that it does not 
generate. For example, an Issuing Bank 1 for electronic dollar notes 11 may be a Correspondent Bank 2 for 
electronic notes 11 of yen, marks, issued by other banks etc. 

It is also important to note that system of the invention can function without correspondent Banks 2. For 
examole a subscriber can eliminate the use of a Correspondent Bank 2 by communicating directly with 
his/her issuing Bank 1 when making a deposit, withdrawal, etc. Correspondent Banks 2 are ncludeo in he 
preferred embodiment for the practical purpose of expanding distribution of the system while reducing the 
risks that are inherent in any banking system, such as the risks caused by the collapse of a bank issuing 

m0,1 The Clearing Bank 3 is utilized when more than one bank is issuing electronic money. According to the 
invention, it is anticipated that more than one bank will be issuing electronic money. Thus, the C earing 
Bank 3 is provided to clear the electronic money deposited and to balance accounts it maintains for the 
Issuing Banks 1. The Clearing Bank 3 maintains demand accounts for each Issuing Bank 1 in the system. 

The Certification Agency 28, is the centerpiece of the system security. It provides a process that 
"certifies" the validity of a money module for a certain period of time by issuing a certificate to each money 
module. A money module must have a valid certificate in order to be able to transact with other money 

""^Before ^certificate expires, it must be updated so that a subscriber can continue to use his/her 
transaction money module 4. This process makes users of the system establish periodic contact with the 

Certification Agency 28. ic 

Periodic contact allows for faster response when tampering with the money modules of the system is 
detected To this end, the Certification Agency 28 also provides a list of offending or compromised money 
modules to other money modules so that transactions with the bad units may be blocked. 

The components shown in Figure 1 are best understood by referring to the systems operative 
arrangement illustrated in Figure 2. As illustrated in Figure 2, the preferred embodiment provides for 
supplements to the current banking systems that include the following additional components: a plurality of 
the Transaction money modules 4, the Teller money modules 5, and the honey Generator modules 6, for 
creating, transferring and storing the electronic notes 11 (money); a Clearing System 13 to balance he 
accounts of banks issuing currency and credit; a security system 21 to maintain the integrity of the 
electronic notes 11; the current banking systems 20; a network 25 (exemplified by the lines interconnecting 
modules and systems) to mediate transactions between money modules 4,5,6. the participating banks 1,2 3 
of system 20 and the security system 21; a Transaction Reconciliation system 22 to detect money module 
malfunctions and insider tampering of the system; a Money Issued Reconciliation System 23 to detect 
counterfeiting and reuse of electronic money; and a Money Position System 24 to keep track of the 
electronic money in circulation. 

Playing mayor role in the preferred embodiment are three classes of "money modules for creating, 
storing, and transferring the electronic objects that represent economic value. These include the Transaction 
money modules 4, the Teller money modules 5, and the Money Generator modules 6. It is contemplated 
that these money modules 4,5,6 will be a combination of tamper -proof hardware and application software 
that are meant to be components of a larger processing environment. 

Referring to the top right-hand side of Figure 2. a Transaction money module 4 containing electronic 
notes 11 stored therein (not shown) may be used to exchange foreign currency or make a payment with 
another Transaction money module 4, using a secure, encrypted protocol either by a telephonic link, or a 
proximate communication link. Because it is contemplated that an electronic note 11 will be fungible, i.e., it 
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can be broken into any desired amount, the amount transacted between the Transact-on money modules 
™„ hP of anv amount up to the amount stored in the payor's Transaction money module 4. 

"a Lvee's T^acton money module 4 that has received the electronic note 11 as a payment may, n 
• h P Id to transfe all Tany amount of the electronic money contained therein to another subscriber's 
rnsa^mon:; TZllZZL*. the payee may deposit the electronic money into his/her banK 

aCC °The value of the electronic money stored in the Transaction money module 4 may also be redeemed at 
m ?SS; banMe g- Correspondent Bank 2 or Issuing Bank 1) for paper money by transferring any 
of th electronic money to a bank's Teller money module 5, whereby a teller or an Automated 
TeZ Machine (^1. return an equal amount of paper money. Naturally, it is anticipated that paper 
mn,, fli<?n hp exchanaed for equal valued electronic money. 
Z Z« S SSS the T,» ns .«ion money module 4 may be configured <o m.ke *po«* 

^ a bX» ™ie, money mod* 5 medietes m» .™ S *ceon S *>' •» subscribe,'* benk .ccoun, as »ell 

ac thfi bankina svstem's electronic money accounts. 

TshouW be noted that a subscriber will not be required to maintain a bank account in order to own and 
use a Transaction money module 4. For instance, a subscriber may obtain a stand-alone computing 
device 2 contains a Transaction money module 4 and use the device only in off-line Pe*-to-pe« 
frsactions vSth other devices containing a Transaction money module 4, such as a merchant's P°ir*-of- 
sa,e Sm^ Of course, the merchant may then transfer the electronic money to another commerce, 
oroanization to meet its obligations, or it may deposit the electronic money at its own bank. 

9 Tn ZpreteSl Embodiment, electronic money deposited at any Issuing Bank 1 other than the original 
.ssu m Lnk 1 Self will subsequently be settled for value with the original Issuing Bank 1 through the 
ceS cla^ng and selng process performed by the Clearing System 13. .t is anticipated that the clearing 
»nH tmZ orocesses wiU be managed by the Clearing Bank 3 (F.gure 1). Each Issuing Bank 1 Teller 
^ney moLrs sends 3 "the Tronic notes 11 deposited at its bank but issued from other Issuing Banks 
1 tn the Clearina Bank 3 in order to settle for the value posted to their customers accounts. 
1 * When TSSZl an exchange for foreign currencies, an exchange of paper cash for ele = c 
monev or an updating of the electronic money occurs, the Money Generator module 6 Figure 2 creates 
»nri I riLt l TsZs eeStronic objects having economic value - either currency or credit notes 11 (Figure 1) 
^^oTJe^tiTn^-clto money modules 4 through the participating bank's Teller money 
modules 5 in the form of a packet of electronic notes 11. As mentioned above, the electron* currency notes 
J! ^ the equivalent of bank notes that are backed by deposits, and can be traded between Transaction 

m Tun^rthe S vvithdrawal transaction, the Teller money module 5 and the Transaction ^y rtM 
may establish a communications link using an encrypted protocol to securely transfer the notes 11 from the 
Teller monev module 5 to the Transaction money module 4. 

ReTords of the notes 11 generated and conveyed by the Money Generator module 6 are sent o the 
.oc a r?ank-s Transaction Reconciliation System 22 and an Issuing Bank's 1 Money Issued Reconciliation 
SvSem 23 for maintaining statistical and housekeeping functions. Records of the electronic notes 11 
cleaned and settle?* the Clearing Bank 3 are also provided to the Money Issued Reconc.iiat.on System 23 
« From ^e compilations, a financial position of the system can be produced by the Money Position 

SySt D^cre 4 pancies and malfunctions are reported to the Security System 21 which downloads the lists of 
oroblem money modules to all money modules in the system when they are connected to the Network 25 
BrXing th's list, a Transaction money module 4 wil, be inhibited from transacting with other suspect 

50 Jr ™^^rXZVo*e^ of the preferred embodiment, there wi„ now follow a more detailed 
description of the individual elements and the transactions between them. 
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Rqure 3 provides several embodiments of external systems or devices for housing money modules. 
In the preferred embodiment, the external system or device will typically contain data display means 
data input means, data processing means, memory storage means, direct connecfon or contactless 
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bidirectional communications means, and the money module packaged in a tamper -proof housing, all 
interfaced bv suitable means for information transfer, such as are well known in the art. 

devices (fixed or portable) connected to a network. financial comDuter 

A Teller money module 5 may be embodied as a coprocessor m the banks financial computer 
systems The Mone'y Generator module 6 could be a separate processing unit networked to , fte bank a 
co pTocessor in a general purpose computer, or it may be combined with an .ssumg Banks 1 Teller 

m0n BeoTuse1 fs'antiSdTaramoney modu.e will be imp.emented in a separate processing device, it 
is aLuTed ihrcorres'ponding interface circuitry would be provided in the host processing dev,ce to 
provide communication between the processing device and the money module. _ 

Notably all classes of money modules contemplated by the invent.on may be implemented program 
maticairor'by direct electrical connection through customized integrated circuits, or a comb,nat,on of both 
Sriny of the methods known in the industry for providing the functions described below without 
departing from the teachings of the invention. Those skilled in the art will appreciate that from the disc osure 
of the invention provided herein, commercial semiconductor integrated circuit technology would suggest 
IZoZ ^ernLes for actual implementation of the inventive functions of the money module that would 
still be within the scope of the invention. 

Transa ction Money Module 

In one embodiment, the Transaction money module 4 may be imbedded in any Z 
use. like those serving as general purpose computers or work - stations, to provide functons not tonjedto 
E-M transaction use. This latter application will allow for such uses as real-time, ^off '^^^ 
between personal computing devices, or on-line payments for network services such as information 
retrieval, telephone calls, or for purchasing airline tickets, theater tickets, etc ....... h=mH hplH 

Tn another embodiment, the Transaction money module 4 may be imbedded m an ^^7^ 
integrated circuit unit such as a personalized hand -held computer that may be read.ly earned by an 
SSafas^ ! g vSre a wallet As an illustration, the device of the preferred embodiment maj ^include 
a keyboard a pen or stylus, a touch screen or voice recognition circuitry as a data input means an 
alphanumer c LCD dot matrix disp.ay as a display means, an infrared optica, transceiver as a contacts 
SSonal communications means, and an HJ-11 telephone jack coupled to , ^™ ^^J* 
telephonic communications means. Additionally, the device may also include various etectron, = P^essmg 
and storaae means for providing calculator capabilities, for storage and processing data of the owner etc. 

to «5a that the particu.ar design of the externa, device is not critical tc .the ,nven.c i^and 
other technologies suitable for accomplishing the foregoing functions may also be used. For example an 
LED in** of an LCD display panel may be used; radio, infra red, inductive or capac.tive communications 
methods may be used instead of direct connection, optical communications methods may be used, etc 

Tgenera,. it is anticipated that any Transaction money module 4 owned by a sub senb - be 
embodied in a self-contained, tamper -resistant unit that contains components which are » dfficul to 
access and thus prevent any person from improperly examining, counterfe.tmg or modify.ng any of rts 
contents o alngements. For example, integrated semiconductor circuits, whose contents are difficul to 
examinrencased 9 in a tamper - resistant package such as that formed by an epoxy or P'-^'"*"' 
^ Provide a high degree of physical security while providing the necessary storage, computation, timing. 

and other data processing functions. there nr<=> 

However, the invention is not limited to any particular tamper - res 1S tance means, inasmuch as the e are 
a number o m eth ods known in the industry for providing such security. Such tamper -resistance wH. also 
prevem the owner, who can contro! only some of the internal operations of the Transact.cn money > modules 
rS certain accesses to thereby provide security from abuse to other relevant institutions and 

^Tacfrransaction money module 4 will have a way of ensuring its own association with a pabular 
subsc^ber so that its use by other individual may be limited. In addition to the use of Personalized 
Identification Number (PIN) methods that are well known in the art, the Transaction money module 4 may 
also indude means such as a fingerprint reader, voiceprint analyzer, written s.gnature analyzer, or other 
so-called biometrics means, to determine the physical identity of an authorized subscriber. 
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.HH-.i~.oiiu th» Transaction money module 4 may utilize personalized interactive proofs using ques 
tions tC onf a true own S Z able to correctly answer, such as the owner's mother's maiden name, 
tons that only a > true owne ^ ou techn iques may provide additional security for organizations, and may 

TV^2^™£^~< «* security can protect ,he subsc d ri r 4 s data ,rom 

Section and use by someone else coming into possession of the Transacts money module* 

Because the Transaction money module 4 can take on a variety of phys.cal representations, .t will be 
descrSd by *e functions performed in addition to the pertinent physical characteristics of a preferred 

emb Refe7nq now to Fig. 4. a Transaction money module 4 is shown diagrammatical in block form. 
S-ST.Ccli money module 4 has (1) an externa, interface 30 that interfaces the Transact^ 

S 4 to the module's data processing means, the input/output means (human 

^mmunications circuitry of the external device; (2) a session manager 31 to control and commit (i.e., 
T^nZcL session; (3) . transactor 32 to manage app.ication functions; and (4) a money 

ho, ^lg^^ » — - *• 

actehstic s such as a user's personal identification number (PIN) and biometr.cs *»™»^* 
W nt voiceprint, etc.). that are stored in the memory of the Transaction mono y moduto 4 o those o 
he individual who is attempting to gain access to the Transaction money module 4 After the proper 
ownership is verified, the Transaction money module 4 may be activated, and the user ,s a.tawed certain 
accesse to the Transaction money module's 4 stored contents. Messages to the and 
Jubscnber inquiries as to the information contained within the Transaction money modu.e 4 are also 
handled bv this application function. 

The To Teller application 34 interfaces the Transaction money module 4 to the Teller money modules 5 
for initiatinFind-performing deposit, withdrawal, loan payment transactions, and bank .nquv.es w.th such 

^TZ^Z^^on 35 supervises the sending and receiving of electronic notes 11 between 
Transact ion money m odules 4, managing the process in which the electronic notes 11 are properly 
as to amount, digital signatures, etc. This application provides that the electronic notes 1 are 
transferred in a recognized, valid format. Notably, this is the application that allows a money module to 
perfSm payments and foreign exchanges. Without this application in the preferred embodiment, a 
Transaction money module 4 cannot make a payment to another Transaction money module 4 
Transaction money n x prwides the managerne nt and overseeing of a log that records 

compete d transactions u ndertaken by the money module. For each completed transfer of electronic money. 

an illustrative Tran Log records: 

(1) the type of transfer (i.e., payment, deposit, foreign exchange, etc.), 

(2) the date of transfer, 

(3) the amount of transfer, 

40 (4) the Issuing Bank 1 identifier 
(5) the note identifier, 

S lUe WenSoTthe other money module involved in the transaction, and for deposits, withdrawals and 
loan payments: 
45 (8) the bank account number, 

(9) the bank identifier, and 

(10) the amount of the transaction. ^^in^r 
in the preferred embodiment, every money module will have an identifier. A money module identifier 

may be thought of as the "serial number" of the money module and is never changed. . _ . 

so It is anticipated that a subscriber may have access to several of the fields of data stored m the Tran Log 
application, such as histories of the amount, date, and type of transfer. Information as to the expiration date 
of a certificate may also be accessed by the subscriber so that he/she will be informed as to the need to 
update or revalidate the money module's certificate. 

The Maintain Security application 37 manages a list of money module identifiers that are known to have 

55 been ge nerally compromi sed. In particular, this is a list that is distributed to each money module when it 
communicates with the Network 25, and is a list of money modules that have passed an invalid or 
counterfeit electronic note 11 or have performed acts deemed detrimental to the system. 
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When establishing a session between money modules, each money module checks its list of bad 
m0 nr y modules to se'e if the other is an offending money module. If the other money modules .dentif,er 

^ Pe ^^Z^^^^ the certificate unique to the money modu.e, for 
S ~ ^^^^ 

and va L ofthe Sctro nic notes 11 stored within the money module. A note 11, whether ,t ,s an electron.c 
c " enty note ortn llectronic credit note, is the basic unit of electronic money, .t is the 
R esenting the economic value, the electronic bits that contain the amount, exp.rat.on date note '^nt,f.«r 
X (descrfbed in detail be.ow) that gets digitaHy signed (described beiow) and encrypted when be,ng 
transSerTed L Both electronic currency notes 11 and electronic credit notes 11 may be located by the Note 

Dire ?he y Note Directory application 39 updates summary tota.s of the current amount of electronic notes 11 
(both currency and credit) by monetary unit after every transfer. A date -of -expiration, a note .dentif.cation 
number and an Issuing Bank identifier is also recorded with the location of each note 11. 

T summa?v the Note Directory 39 keeps track of the note identification number, the Issuing Bank 1 
idJtLI ^ThTdatr-of-expiration of the note 11, the location of the note 11 as stored in the Transactor, 
TnS moduiet and thecurrent amount of the total value of the notes 11 stored for each monetary umt 
These records are maintained for both electronic currency and electronic cred.t. For a cred,t note 11, the 
account number of the credit line is also maintained. ii 

The Notes application 40 manages the storage of the representations of the electrons notes 1 
themselexSth currency and credit notes 11. This application also generates the transfers when notes 11 

?he%Tck7Manager application 41 manages the construction and formatting of a packet of electronic 
notelll^SSrl^trariferred to another money module. For example, the Packet Manager 41 «,M 
Size an Sorfthm so that the least number of electronic notes 11 are used to fulf.ll the requested amount 
o ransfer ^ S the ear iest dated electronic notes 11 being used first. Alternatively, when a packet of notes 
llTtfansfe r e d to the receiving money modu.e, the Packet Manager 41 application "d.sassemb es the 
packet vehfying the date and separating the data Holds that represent the different el n^es 11 
^formatted packet gets several data fields appended to it when electron.c notes 11 are assembled^ 
An identi^rdafa field provides the indicia that identifies it as a packet. Additionally, data f.elds for the total 
value of the notes 11, the number of notes 11, and the individual locations of the notes 11 are P™'^ 

The Ver^fapp cation 42 verifies that a received packet contains valid electron.c notes " before a 
receiving^e-y module accepts them. The Verifier 42 also checks that the total amount received .s equa 
o The s 9 um of the electronic notes 11 that are to be transferred. If the total amount and the .nd^dua, 
electronic notes 11 are valid, an acknowledgment is returned to allow for complet.cn of the transfer. 
Otherwise an "invalid" message is sent, and the transfer may be aborted. 

Slices ^^applications that are provided fal. under two categories: ^S^J^^^J^ 
ClocTOie743 provides output pulses for controlling a transaction timeout, such as the time between the 
sendina of a message and the return of a corresponding message. 

As J be appreciated, when two money modules are communicating, they may be mon.tormg a time- 
out protoco.. Fo/examp.e, after a first money module has sent a message to a second money modu e the 
Session Manager 31 of the first money module ("A") may set a timer for a reply rf the Transactor _32 
TndSes that a reply is required. The Session Manager 31 may also number the message sent. Th s 
S^wouW appear in the reply message from the Session Manager 31 of the second money modu.e 

( " B 7f the timer expires before the message has been received, then Session Manager A 31 will query 
Sess on Manager B 31 to determine if the transaction is still running in B. If B does not reply ^then Sess on 
Manager A 31 1 will abort the transaction. If a reply is received that the transaction ,s proceeding, then the 
tTme? will be reset to a new time, if A queries B a predetermined number of times without receiv.ng a reply 
to the oriainal message, then A may abort the transaction. 

le P 2ate. y , this application also maintains the current date and time, both for user disp.ay and fo 
verifying that an electronic note 11 to be received is not an expired one, along w.th other general clock 
functions that are commonly used in the industry. 

The Cryptography application contains a Public Key 44 operation, a Symmetr.c Key 45 operation, and a 
Random Number Gen erator 46. While the tamper - resistance of the Transaction money modu.e 4 and 
components makes it difficu.t for a person to modify the structure of the d ° v,c * 

cryptographic techniques are also employed to provide secure commun.cat.ons and payment transfers 
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be ToU™7cZoT*M «. as is wel. known in the art, may be emp.oyed by this app cation to prov.de 
pub ifc key d7git a 7signatures . which are calied "digital signatures" or simply "signatures' for brev^ The 
Sata in electronic notes 11, may be represented by a digital number. The electron* notes 11, are s^ned by 
. dS. ^. stnatures formed from this number. A digital signature can then be checked as corresponding , t a 
SSLS message by anyone knowing the corresponding public key. which in the preferred embodiment 

^tSZZrXZ!^ money modu.e with the ability to check the digital ;= e for 
authenticity A money modu.e receiving the digitally signed electronic note 11 can ,n turn s.gn and transfer 
M it to others who could also check, sign and distribute tt 

Because o? the "one way" nature and computational complexity of public -key d.g.tal signatures, ,t .s 
thought ^be "feasible to decipher and duplicate them within a feasible period of time, making such a 
security system resistant to forgery. 

Lastly, this application also creates new public and private keys when needed. 

Symmetric Key cryptography 45 provides private key algorithms that are well known .n the art, for 
15 indi vTduTsession^ecuyand' privacy between money modules. In the preferred ™»*™£J% 
Xncation provides encryption/decryption means in order to secure informal be.ng exchanged between 

*" Z^lT, symmetric key cryptography technique, such as the National Data ^J^TZt 
fDES) system or other cryptography techniques, may be provided in th.s appl.cat.on. For example, due to 
he fnc eS interest in priding cryptographically secured communications manufacturers are providing 
various semiconductor integrated circuit devices which perform the encrypt.on and decryp .on of _da£ 
Slink corporation's C.DEC data encryption devices are examples of commeraally ava^ble 
encryption/decryption circuitry that would be suitable in the present invent, on for th.s apphcat .,on_ Due to the 
federally mandated use of the DES algorithm, devices such as these are w.dely utalized to .mplement that 

^T^mportant to note that the details of the particular cryptographic methodology utilized by the money 
modules are not critical and are not limited to a particular cryptographic techn.que. 

The Random N umber Generator 46 generates random like numbers for creating new pubhc/pr.vate keys 
for the Public Key application 44 and new private keys for the Symmetnc Key 45 appl.cat.on. Th.s 
application is utilized to vary in an unpredictable way the generation of temporary sess.on keys 

Circuitry for providing such random number generation capability are well known .n the art. For 
instance a y cir cuit P uti.i 2 ing 9 a "noisy" diode may provide random values, as is well known , in the «du*y 
Random numbers may also be provided by a pseudorandom number generator c.rcuit wh.ch .mplemen s ^a 
mathematical algorithm, such as the power - residue algorithm, that generates apparency random values 
from a "seed" number. The use of clocks or counters provides another often used source of random data. 
As will be understood, the Random Number Generator 46 may use techniques that are well known to a 
person of ordinary skill in the art to generate the temporary numbers, and thus need not be further 

^"should be further understood that the foregoing functions disclosed herein may be performed by 
known programming techniques and/or dedicated hardware and in some cases may be combination of both 
or shared resources from each. As may be appreciated by a person skilled in the art many changes jr .form 
and detail can be made in dependance on specific application requirements w.thout deparftng from the 
essential features of the money modules. 
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Telle r money module 

The banking systems 20 of both the Issuing Banks 1 and the Correspondent Banks 2 interface to the 
system of the invention through a Teller money module 5. The Teller money module 5 may be '™beddec Nn 
any general purpose computer or workstation. The particular design of the Teller money module 5, hke We 
Transaction money module 4, may be implemented in readily known programming techniques or ded.cated 
computer hardware, or a combination of both. As will be appreciated by a person skilled in the art, vanous 
designs of the Teller money module 5 may be employed to implement the functions descnbed herem^ 

The details of one embodiment of the Teller money module 5 is shown in block form .n Figure 5. The 
Teller money module 5 contains many of the same components and application functions of the Transacts 
money module 4 described above. Therefore, the identical components will only be repeated briefly here, 
while the distinguishing components will be fully described. It should be noted that the Teller money 
module 5. like other money modules of the system, is also contained within a tamper -proof enclosure of 
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the type common in the industry, so as to ensure the necessary security involved. Tran „ rtnr 32 

The Teller money module 5 contains an External Interface 30. a Sess,on Manager 31, a Transactor 32 
and a Money Holder 38 that perform similar functions to the corresponding components in the Transaction 
monev module 4 described above. . 

Briefly the External Interface 30 interfaces the Teller money module 5 to other processing and 
communications means within the Teller money module 5 host processor; the Session Manager 31 acts to 
control and commit (i.e., finalize) or abort a transaction session between the Teller money module 5 and 
another money module; the Money Holder 38 manages the storing and retrieval of electrons money and 
STfSnJS?32 manages the application functions of a To Te.ler 34. the Tran Log Mgr. 36, the Mainta.n 
Security 37, the To Bank 47, a To Money Generator 48, and the To Transaction 49. 

The following list describes in brief, the applications contained in the Teller money module 5 that are 
functionally identical to the applications found in the Transaction money module 4: 

- To Teller 34: Interfaces deposit and withdrawal functions to another Teller money module 5 . 

- Tran Loq Mgr. 36: Transaction log manager for recording transaction details. 

- Maintain Security 37: Manages the list of compromised money modules, applies for certif.cates, 
synchronizes the clocks, and manages the creation of new digital keys. 

- Note Directory 39: Keeps track of the location, value and identification of notes 11 by monetary unit. 
Summary totals are also maintained. 

- Notes 40: Manages storage for the electronic notes 11 of exchange, and creates the transfers for the 

- Packet Manager 41: Manages the assembly and dissembly of a packet to be transferred to a different 

money module. 

- Verifier 42- Verifies that a received packet contains valid electronic notes 11. 

- ClockTTimer 43: Controls transaction timeout expiration of the validity of the electronic notes 11, 
expiration of the certificate, and general clock functions. 

" Q^P^S 44: used for signatures to sign and validate notes 11 and to set up a secure transaction 
session. 

(ii) Symmetric key 45: Controls the security of a transaction session. 

(„,) Random number generator 46: Generates random like numbers for new cryptographic keys. 
Some of the distinguishing applications are the To Bank 47 and To Transaction 49 ap plicat. ons. The To 
Bank application 47 provides the interfacing means whereby the Teller money modute 6 ca r. perform 
elEhanges of data for inquiries and account postings with the on - line systems of a bank. Th.s apphca ton 
is also utilized for crosschecking the customer's account number with the accounts and type of transaction 

35 be,n 9 h r ® q ^ St T J ansactjon app | ication 49 performs deposits, withdrawals and payments to loans. This 
applicati on operates whe never a Teller money module 5 is transacting with a subscnber s Transaction 

m0n As mentioned above, a Teller money module 5 may be associated with an Issuing Bank 1 or a 
Correspondent Bank 2. When Teller money module 5 is associated with a Correspondent Bank 2, it is 
utilized for intermediating deposits, withdrawals, and payments to loan accounts between a Transaction 
money module 4, the Correspondent Bank's 2 on-line systems, and an Teller money module 5 at an 

ISSU Whe B n a o k perating in an Issuing Bank 1 mode, the Teller money module 5 is used for intermediating 
as deposits, withdrawals, and payments to loan accounts between other money modules and the Issuing 
Bank's 1 on-line systems. Additionally, when the Teller money module 5 is performing in an Issuing Bank 
1 mode a To Money Generator application 48 may be employed when requesting new notes 11. 

Basica lly the To Money Ge nerator application 48 performs banking functions dealing with requests for 
electronic notes 11. It interfaces an Issuing Bank's 1 Teller money module S to a Money Generator Module 

50 6 All of the other elements performed in an Issuing Bank's 1 Teller money module 5 are essentially 
identical to the similarly named components and application functions described above. 
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Figure 6 is a block diagram illustrating the application functions of a Money Generator module 6. Money 
Generator modules 6 provide the mechanism that Issuing Banks 1 utilize to issue electronic money. A 
Money Generator module 6 is also encased in a tamper - resistant package for the same security reasons 
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S,at A ^Z^:ZL7tT^ the e.ectronic money (in the form of e.ectronic notes 11. to be 
de^iSTlS5rSwi below), and distributes them to other money modu.es through the Teller money 
S 5 an issuing Bank 1. The Money Generator module 6 includes a unique appl.cat.on not present in 
^r money mod^s for responding to requests for e.ectronic money. This is the Money Creator 

aPPl T C he O M O 5 n 0 ey Creator application 50 creates and formats the e.ectronic objects representing value - 
eiJr cuF rency backed b y demand deposits, or credit authorizations - and digital.y signs these "electrons 
ISZ IV usino. public key cryptography in conjunction with its secret key, so that it may be sent to an 

^oX^ZZ^Z^^e 6 the To_Bank app.ication 47 notifies the bank systems ofany 
irregularities, off-loads transaction records in the Tran Log to the Transaction Reconcha ^ Syste m 22 
and transfe s electronic notes 11 to the Money .ssued Reconciliation System 23. A o the other 
applications of the Money Generator module 6 are identical to the similarly named a PP hcat,ons of the 
money modules described above. 

Th e Network 

According to one embodiment of the invention, the individual components of the present invention may 
communicate over a Network 25, as shown in Figure 7. The Network 25 will link together the Issu.ng Banks 

I Correspondent Banks 2. the Clearing Bank 3 and the Certification Agency 8. 
Transaction money modules 4 may be coupled to the Network 25 over the telephone exchange or v* 

special terminal facilities at bank locations (e.g.. additional contactless or cable connect, ons at an ATM 
booth). A communication .ayer wi.l carry transaction requests (e.g.. deports, withdrawa >*^^ ^ 

II and new certificates securely across the Network 25. In the preferred embodiment, the Netwo * 2 w.n 
also provide directories of financial services, and update the money module clocks and the bad money 
module list of all money modules. . 

As will be understood, the Network 25 may use well known data link or commun.cat.ons systems and 
techniques that utilize, for example, telephone lines, fiber-optic land lines and satel.i tes and that mc ude 
connective, timing and control software and circuitry for allowing access and transm.tt.ng d.g.tal information- 
The Network 25 may use commercially available protocols and operating techniques such as those set forth 
by the international Standards Organization ("ISO") for Open Systems Interconnect n .^° rk ^ardj It _.s 
important to note that the particular design of the Network 25 .s not cr.t.cal and su.table technolog.es for 
accomplishing the foregoing data communications functions may be used 

Each entity (Banks 1 and 2. Certifying Agency 28, or Clearing Bank 3) ,s also assumed to have an 
individual local network 16, 17. 18 and a gateway to the larger system Network 25. The larger Network 25 
will provide directory services for the routing of messages to connect to the approbate local network 16, 
17 18 The local network 16. 17. 18 has the responsibility of routing messages to the correct money 
module or Security Server 27. A Security Server 27 is associated with each participating bank and the 
Certification Agency 28, and is used for implementing the security of the system. 

Figure 7 illustrates the preferred embodiment of the Network 25 generally, indicating that money 
modules of any participating bank may be intercoupled to the money modules of other banks and f.nancial 
institutions, or another subscriber's Transaction money module 4 via a communicat.ons ink <*rect'y 
connected into switching and processing centers and alternatively connected to a local network 16. 17, 18 
45 at each entity 

A money module need only identify the local network 16. 17. 18 destination (typically a bank 
subnetwork) for the transmission of most messages. The local network 16, 17. 18 will route the message le- 
an appropriate money module for establishing a session. Once a session is established, the Network 25 
directs all messages between the two money modules. The Network 25 also controls messages between 
so money modules and Security Servers 27. -.un^aic 
Transaction money modules 4 may communicate over the Network 25 for deposits, withdrawals, 
payments to loan accounts, updates or inquiries. The Teller 5 and Money Generator modules 6 will s.gn on 
the Network 25 periodically to update security information. The sign -on will be initiated by the money 
module Session Manager 31. or by the bank Security Server 27 if recertification is required or if there are 
55 changes to the bad money module list. . 

A bank services directory may be available to the money modules primarily for updating the electronic 
notes 11 and performing foreign exchange. A list of participating banks for either service will be available 
from the Network 25. 
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SJT£ S^^TTSiifS* » in the 25 ever, m. M ft. — » 

(2) Communication Session Manager 57 manages a commun 
and between a money module and the Security Server 27. 

(sTRoutrMessage 60 - directory services for routing messages, controlling message routing during 
^Z^^^^V^^o, « — »' 0Vided by Partidpatin9 n the 

that is coupled to the same centers. 
E lectronic notes 

various times and ,n nnous points a the > w«^ »• ™ y ^, seversl , ransaelions lus t like papor 

'"^tnrtype of electronic note 11, i.e., whether it is a currency note 11 or a credit note 11; 
(2) the Issuing Bank's 1 identifier; 
55 (3) the monetary unit identifier; 

(4) a Note identifier; 

(5) its date - of - issue; 

(6) its date -of -expiration; 
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(7) the subscriber's account number (used only for credit notes 11); 

(8) the amount or value of the note 11; and 

(9) the Money Generator module 6 identifier. 

Or.^ST^c.^^ electronic note 11 was transferred; (provide, for currency 

oMransfer records that indicate to whom the apportioned note 1.1 was transferred from, the 
Ste S-lnsfer, the amount transferred and the identification number of the rece.ver. 
The Signature and Certificates group of data fields includes: 

(1) the digital signature of the Money Generator module 6; 

(2) the Money Generator module 6 certificate; 

(3) a list of payers which contains each payor's signature and certificate; 

(4) the digital signature of the payor; and 

signed "ansTer Scord indicating from whom it is transferred is appended Thus, the recipient of an 
electronic note 1 1 will also receive a record of all of the past holders of the note 11. 

fTexanJe a $50 electronic note 11 may be generated, and withdrawn by a Transaction money 
m J,Z r ^sumino it is transferred to other money modules in $10. $10. and $30 denominates the 
Sent m^rmodls ^receive the note 11 with the transfer record identifying the first 
recipient money reciD ient of the $10 note 11 transfers $5 of it to a th.rd party, the third party 

money mo*£4 When JJPJJ*^,^ the previous ^ holders. Assuming this $5 note 11 is 
IheTdeposLd a io d of Twi. be " Shed with other segments of the original $50 note 11 that find there 
way Eto th banking system by the clearing and reconciliation processes of the present embodiment 

y OnTy the receiver of the transferred note 11 can either deposit the note 11 or use it m payment. The 
Verif?er 42 appTca^on of a money module is used to check the signature of each transfer to determine f 
Z no e 11* vaTd and to verify the identifier in the last transferor as the current holder of the note > ir Th.s 
n rt 1the new holder of a note 11 from trying to use a value greater than that wh.c i was transferred. It 
a^o inhibits copying notes 11 for use in another money module since the identifiers will not ™tch. 

As can be appreciated, a subscriber may be able to access certain informat.on about the electrons 

45 M *l££T SSSS TZe^ information on the total amount of the electronic 
notes 1?SS: Z moX unit of the notes 11. the type of electronic notes 11. i.e.. currency or cred.t, 
and the denomination of each note 11. 

Sy stem Security 

50 The security of the system is maintained by the participating banks and the Certification Agency 28 
whiJTLates and d stributes money module certificates. A certificate of a money modu.e is actually a the 
^^to^SETto Public key, a digital signature of a money module's identifier and pubhc key 
SJ5 Scribed below), and the version of the certificatory key. The certificate ,s unique ,n that ,t 

55 ^ -^S^^^r^ans for money modules to » f 

transacting, first by controlling the money module certificate process and second, by d.stnbuting a l.st of 
bad money module identifiers. 
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module by the Certilicatlon Agency 28. The Certificat on 9 28) „ mBy „ 0 ch ,„ged 

expected that only a few versions need be kept cre ation. Upon expiration of the 

A create win on,, '^^^l^ 2 S« ™-» -odu.es. Any money 

r ecei,e the latest »s. <* o»ending money ■ n»dul- f^c^Tfc^th. '»»« 

Transaction money modules 4 access the ^ rtlM '» ''f^J^ 5in addition lo 1h. lime limit 

list. Placing a time limit on the Transact™ money module A ..„ y 28 ,h,ough the 

placed on electronic notes 11) will force ~°~£* u ,f *?Sg with the a n,« cemtioate. 

s ~Th.cX T r c^ -^^^^ 

r,rfy str'.sxi «s ^ «-"» ^ - - ° ert,tow 

^"^1^^ oonneotlng to a ban,s local netwo* 1. or the 

SSSS SKS"" S5S 2 security aspeots o, .transaction session; 
„ S SS — . - Clues a oortitica* .or any o. me money modules 

hiss, r-iwTr^rrnerir : ™ , e p _, — «. 

'ofSbote Certification Keys 52 -dis.nbu.es .he Certification Agency's 28 Us, o< v.«d public k .ys to 

35 the money modules; H;*trih. it^ the> list of bad money modules; and 

(6) Bad Money Module Control 53 - cont ;;° ,s f an ^^ module s described above 

Certification Agency 28 after being digitally signed using the old pnvate toy. ^ 
The Certification Agency 28 checks the «0n«u» anc ■* * »^ exp ? r atVn date. The Certification 
identifier and sends the certificate to the money mod fj^^^J^ * ° the Network 25. Initially, 

50 Optionally, only those money modules which have demonstrated a flagrant breach ot xy 

"tszsszzzs^- — i «— -r.dr«^eTireS 

Certification Agency 28 so that the money module .dentrf.er may be placed on the bad money 
to inhibit any further transactions. to - block a money module from transacting, 

" JT^^ - -Sr"*-«^S^-^. --n,0 no.es « ,n eddi«n to 

the money module certificates. 
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♦ ^ir*,^ a note 11 wild be valid only for a limited time period after it is generated. Its 

r,r,t 0 11 mav be set to expire after a month from the date of its creation. 

A ^TrTnsacUon moTy module 4 wi.l not accept expired notes 11. but can deposit or exchange the notes 
11 H mTconS toZ notes 11. The expiration dates are checked by the Verifier 42 and C ock^Timer 43 
lip caSns i a money module before any electronic note 11 is transferred. Separately ■ t « > a*o 
o anticipated that if the money module loses power then it will not be able to pay or exchange notes 11 after 
iZr tas oeen regained until it has communicated again with the Network 25 and had its secunty 

P Tsttated1oiv d e, a subscriber wil. typically obtain a Transaction money module 4 already loaded with ,. 
certificate Securing the Transaction money module 4 itself to a subscnber may be accomplished by 

s assioninq it a unique PIN, biometrics or other personal secret characteristics. 

Before any personalization of the money module 4 may proceed, the Transacts money module 4 
checktif Lre^sTbank account already stored in the To Te.ler 34 application or if the Notes 40 : apphcation 
contains any electronic notes 11. In either of these cases, the Transaction money module 4 w,.l ,nh,b,t the 
subscriber from securing the module with new secret information. subscriber 

20 If the Transaction money module 4 has no account numbers or no stored notes 11, then the subscriber 
can secure it by either entering a PIN, which is reverified by the Transacts money module 4. or by 
exec ting a process in which the Transaction money module 4 learns the subscriber's b^metncs. Once the 
DersoSation has been completed, subscriber access to the Transaction money module 4 requires the 
E=S~" of a sig'-on in which the secret ^^---T^^^T^Z 
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mo C duT4 U irr sZc^r can s^n on te the' Transaction money moduie 4. then he/she w, be permitted 

te TS^t^J!SS 1L h- forgotten his/her P.N or had an incident which has affected 
his/her biometric reading, then the subscriber may take his/her Transaction money module 4 to a 
oartcipating bank A special transaction may be executed which deposits any electrons notes 11 in a 
S ^account and destroys the stored bank account numbers. The subscriber can now enter new secret 
sign -on numbers and characteristics. Any electronic notes 11 that were removec 
Transaction money module 4 and the bank account numbers may then be recreated (see Bank 

^Tsho'STJ'noted that it is not a requirement for a subscriber to identify himself to the s ystem , when he 
takes possession of a Transaction money module 4. Though the identity of the money module is contained 
KTSSSS. the holder of a Transaction money module 4 can be kept secret, .f the re ationsh.p-s 
eveS then one could trace all of the transactions of a subscriber for the period that the relationship can 
^ corroborated. The only time a subscriber must reveal his identity is if he/she links the money module to 
a hank arcount or wishes to redeem money lost. 

TthTLbscnber chooses to use the Transaction money module 4 only for payments and foreign 
exchange then he/she can keep the relationship secret. As may be appreciated, the subscnber may also 
acqu^a plurality of Transaction money modules 4 and, for example, link one to bank accounts and 
maintain the others for anonymous payments. The other Transaction money modules 4 may be loaded w.th 
notes 11 by exchanges with other money modules or by exchanging for cash notes 11. 

Replac ement of Money Mudule Value 

If a Transaction money module 4 malfunctions or is lost or stolen, it may be possible for the subscriber 
to recoup the value that was stored in the money module at the time of the incident. Th>s would necessitate 
that the subscriber relinquish the option of anonymity for that money module, since upon making a c aim for 
the lost money, he/she would have to verify that he/she is the owner of the Transaction money module 4 

To provide for the replacement of electronic notes 11. the subscriber may first link his/her Transaction 
money module 4 to a bank account or register ownership of the Transaction money module 4 w.th , the 
Certification Agency 28. After every transaction involving the transfer of electronic notes 11. the subscnber 
could save the Tran Log. which identifies the counterparty money module identifier and the note identifier, 
to inexpensive, non- volatile storage which is removable from the host computing environment. This log 
may be presented by the subscriber when making a claim to replace value. The log may then be compared 
to reconciliation files to determine the true value of the lost electronic money. 
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An alternative to this procedure would be to refresh the money in the Transaction money module 4 
frequently This would mean that the notes 11 in the Transaction money module 4 would be represented by 
transaction records at the Issuing Banks 1. The existence of the notes 11 could be verified by scanning 

these files 

A third alternative would allow the system to capture a money module's Tran Log when money is 
refreshed These records would be copied and routed to Issuing Banks 1 for storage on the,r transaction 
histories. The existence of the notes 11 could then be verified as in the previous alternative. 

Bank Access 

According to one aspect of the invention, a customer's Transaction money module 4 may access 
his/her accounts for deposits, withdrawals, transfers, etc., at any bank participating in the system and m 
particular any bank holding an account with the subscriber. For instance, a typical subscr.ber may have a 
savings account and a checking account at one of the participating banks, while mainta.n.ng a so-caHed 
money market account at a separate financial institution, and perhaps a credit -line account at a third 
participating bank. It is anticipated that a subscriber's Transaction money module 4 will access his/her 
accounts for deposits, withdrawals, loan payments and inquiries at any bank or financial institute wh.ch 
can be accessed through the Network 25. 

If a subscriber has multiple accounts, the subscriber's account relationships with a bank w.ll be stored 
in an account profile in the To Teller 34 application of the Transaction money module 4. The multiple 
accounts can be linked together by the personal account number ("PAN") associated with the mdiv.dual 

subscriber. , ., 

The account profile may be created either in person, under the control of a bank subscriber service 
representative at a branch, or over the telephone utilizing a special dialogue. For example, the subscnber 
may identify himself by his PAN and PIN. He may then enter each account number he wishes to access 
from his Transaction money module 4. The account numbers may be verified in the bank's account 
reference files. A cross-reference of accounts to Transaction money modules 4 may be maintained by 
each bank if they so choose. 

The composition of an exemplary account profile may be: 
30 (1) Bank Identifier - - one for each bank; 

(2) Account Numbers; 

(3) Account Types - - e.g., checking, savings, credit; and 

(4) Security Server's 27 signature on the list of accounts. 

It will be understood that the list of account numbers will be digitally signed by the bank Security Server 
35 27 As a further security measure the account profile may be re-signed with an updated public key on a 
periodic basis. The fundamental access security is provided by the digital signature of the bank's Security 
Server 27. 
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Banking System (Accounting Architecture) 



It is an notable feature of the preferred embodiment, that the method of the system can parallel the 
existing and varying types of accounting methods that exist today. The system of the preferred embodiment 
follows the various types of accounting methods practiced presently in various banks. However, it is 
important to note that unlike the present banking system, in the preferred embodiment of the invention, 
45 economic value is created on demand. Thus, there is no inventory of cash or checks involved; electronic 
currency from demand deposits an electronic credit are created on a real-time basis. This elimination of a 
paper inventory by using an electronic media of exchange requires certain supplements to the commonly 
practiced accounting techniques to provide the real-time accounting needed. 

Accordingly, the embodiment of the present invention provides an accounting structure to supplement 
50 those used in the present banking systems 20. The improved accounting arrangement may be utilized to 
monitor the electronic money and each bank's obligation when a financial transaction between a Transaction 
money module 4 and a Teller money module 5 occurs, or when a Clearing Bank 3 performs any clearing 
processes. 

When electronic notes 11 are transferred to or from a Teller money module 5. in most cases accounting 
55 transactions affecting the records of the banking system 20 are created. Conversely, transfers between 
Transaction money modules 4 do not involve any formal accounting procedures - - they involve only the 
transfer of electronic notes 11. 



18 



BNSDOCID: <EP 054229BA2_I_> 



EP 0 542 298 A2 



70 



75 



20 



25 



In the system being described, it is anticipated that the following arrangements of accounts are to be 
utilized for each type of bank, categorized under each monetary unit: 

mSX^ Acco'unt: A liability account which reflects the money issued but not cleared. 
2 Monev Due Account- An asset account reflecting the money deposited to the bank's accounts, 
g olZ^axa^ g Bank Account: An asset account reflecting the balance of a clearing account at 

Lr^espondent Bank Money Account A liability account owned by a Correspondent Bank 2 which is 
drawn upon by the Correspondent Bank 2 to dispense electronic money. 

(5) Money In Transit Account: A zero -balance liability account owned by each bank. wh,ch ,s used to 
temporarily maintain electronic money during a financial transaction. • 

(^Foreign Exchange Account: A zero -balance liability account owned by each bank, wh.ch ,s used to 
handle multiple currency exchanges. 

( ?CSS°S^Tii Account: An asset account reflecting the balance of the Correspondent 

Bank 2 account at the Issuing Bank 1. ^ ^ _ 

S Money Due Account: An asset account reflecting the money deposited to the bank's accounts. 

(3) Foreign Exchange Account: A zero -balance liability account owned by each bank, which ,s used to 

handle multiple currency exchanges. . 

WMoney In Transit Account: A zero -balance liabi.ity account owned by each bank, wh.ch ,s used to 
temporarily maintain electronic money during a financial transaction. 

(1^rs e uing e Ba n nk Clearing Account: A liability account to net the amount of money cleared for an Issuing 

Bank 1. . , . . 

The accounts, with their corresponding symbols, are summarized below: 
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Type of Bank 


Account Name 


Type 


Owner 


Symbol 


30 


Issuing 


Money Issue 
Money Due 

Deposited at Clearing Bank 
Correspondent Bank Money 
Money In Transit 
Foreign Exchange 


Liability 

Asset 

Asset 

Liability 

Liability 

Liability 


Issuing 
Issuing 
Issuing 

Correspondent 

Issuing 

Issuing 


Ml 

MD 

DC 

CM 

IT 

FX 


35 


Correspondent 


Deposited at Issuing Bank 
Money Due 
Money In Transit 
Foreign Exchange 


Asset 
Asset 
Liability 
Liability 


Correspondent 
Correspondent 
Correspondent 
Correspondent 


Dl 
MD 
IT 
FX 


40 


Clearing 


Clearing Account 


Liability 


Issuing 


CA 



Transaction processing, for a transaction such as a request for a withdrawal from sav.ngs, selects 
accounting processes so that the appropriate accounts may be credited and deb ,te c 'according V- « J* 
anticipated that the accounting processes will be using software programs and methods tha are weH known 
in the art and presently available; inasmuch as any of the programs and methods current^ practiced and 
known for providing the foregoing accounting procedures would be suitable for use in the invent.on. To 
better understand the accounting processes of the invention, several examples of typical transactions and 
their associated accounting steps will be described. Wo inn 

Accordingly Figures 11-24 illustrate the accounting transactions for deposits, withdrawals, foreign 
exchanges, receipt of cleared money, electronic money/cash exchanges, and note 11 updates. Figures 11 - 
14 and 19-22 also illustrate the accounting flows when a Transaction money module 4 contains notes 11 
that are not involved in the particular transaction that is occurring. The notes 11 that are not part of the 
transaction are replaced with updated notes as discussed in the security procedures described above. For 
example when a subscriber deposits less electronic money than is stored in his/her Transaction Money 
Module 4 leaving a balance, the electronic notes 11 representing the balance are then replaced with 
electronic notes 11 containing the most up-to-date certificates. This latter case is md.cated m the 
parenthetical on Figures 20-23 and 28-31. 



19 



BNSOCCIO: <FP 0SO29BA2 I > 



EP 0 542 298 A2 



In an example of the accounting arrangements according to the invention (illustrated by Figure 11), if a 
subscriber were to deposit $50.00 out of $100.00 of electronic money contained in his/her Transaction 
money modules 4 at a Correspondent Bank's Teller money module 5 (Step 1), the entire $100 of electronic 
money would be extracted of which $50.00 would first be credited to his/her customer account (herein 
► denoted by "A"), the remaining $50.00 would be credited to the Correspondent Bank's In -Transit account, 
and S100 would be debited to the Money Due account at the Correspondent Bank 2. See "IT" and "MD in 

R9U After the $100 of electronic notes 11 is removed, the notes 11 are deposited from the Correspondent 
Teller money module 5 to the Teller money module 5 of an Issuing Bank 1 (Step 2). In accompl.sh.ng this 
o transfer, the Money Due account at the Correspondent Bank 2 is credited $100 while its Deposited at 
Issuing Bank account is debited by $100; the Issuing Bank 1 credits its Correspondent Bank Money account 
by $100 and debits its Money Due account by $100. 

In Step 3 the updated notes 11 are requested. Thus, the Correspondent Bank 2 requests from the 
Issuing Bank 1 the withdrawal of $50 of electronic money containing the most recent certificates from its 
5 Money Generator module 6. To support this request $50 is credited to the Deposited at Issuing Bank 
account and $50 is debited from its Money In Transit account. The Issuing Bank 1 then debits $50 from its 
Correspondent Bank Money account and credits $50 to its Money Issued account. 

To complete the transaction, the $50 is then transferred from the Money Generator module 6 to the 
Correspondent Bank's 2 Teller money module 5 through the Issuing Bank's 1 Teller money module 5, and 
20 finally to the Transaction money module 4 (Steps 4-6). The net result of all of these transactions is that 
$50 remains deposited in the subscriber's account and $50 of newly issued electronic notes 11 are now 
stored in the Transaction money module 4 of the subscriber. 

Alternatively, if a subscriber begins with $50 in his/her Transaction money module 4 and deposits all of 
it, the customer account would be credited $50 and the Money Due account would be debited by $50 (Step 
25 1 of Figure 1 1 ; parenthetical entries). 

When there are only $50 of electronic notes 11 that are removed, the Correspondent Bank 2 credits the 
Money Due account $50 and the Deposited at Issuing Bank account is debited $50 (Step 2, parenthetical 
entries) This money is then deposited at the Issuing Bank 1 for later clearing, wherein the Correspondent 
Bank Money account is credited by $50 and the Money Due account is debited by $50. Because no 
updated electronic notes 11 need be returned in this situation, the deposit and its corresponding accounting 
is completed at Step 2. . 

The accounting processes of an electronic money deposit at an Issuing Bank 1 insteaa ot a 
Correspondent Bank involve fewer operational steps, which are illustrated in Figure 12. Using the same 
dollar amounts as in the previous exemplary transaction, when $50 of $100 in electronic money stored in 
the Transaction money module 4 are deposited directly to an Issuing Teller money module (Step 1), $50 
would be credited to the customers account (A). Fifty dollars would simultaneously be credited to the 
Money In Transit account, and $100 would be debited to the Money Due account at the Issuing Bank 1. 

Since the entire $100 stored in the Transaction money module 4 is removed and transferred to the 
Issuing Bank's Teller money module 5, it is necessary to return $50 of updated notes to the Transaction 
money module 4. Accordingly, as shown in Step 2 the Teller money module 5 requests $50 from its Money 
Generator module 6, debiting its Money In Transit account by $50 and crediting its Money Issued account 
by $50. 

In response, $50 is created by the Money Generator module 6 and transferred to the Teller money 
module 5, which in turn transfers this electronic money to the Transaction money module 4 (Step 3-4). 

When only $50 is stored in the Transaction money module 4 and all of it is deposited, the customer's 
account (A) is credited $50, the Money Due account is credited $50, and that is the end of it. See 
parenthetical entries in Step 2 in Figure 12. 

In the case of a withdrawal from a Correspondent Bank (see Figure 13), a withdrawal request of $100 by 
a subscriber using a Transaction money module 4 at a Correspondent Bank 2 will cause the subscriber's 
so account (A) to be debited by $100 and the Correspondent Bank's 2 Money In Transit account to be credited 
by $100 (Step 1). The request for the $100 withdrawal is forwarded to the Issuing Bank 1 from the 
Correspondent Bank 2, and the Correspondent Bank's Deposited at Issuing Bank account is credited by 
$100 while its Money In Transit account is debited by $100 (Step 3). 

Next, the request for $100 is forwarded by the Issuing Bank's 1 Teller money module 5 to the Money 
55 Generator module 6. Accordingly, the Correspondent Bank Money account gets a $100 debit while the 
Money Issued account gets a $100 credit (Step 4). 

The Money Generator module 6 then creates the $100 of electronic notes 11, and transfers it to the 
Transaction money module 4 via the Issuing Bank's 1 Teller money module 5 and the Correspondent 
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Bank's 2 Teller money module l KSteps .s s - 6) ^ ^ Transact|on Money Module 4 tnat 

When, e.g the subscriber make i q apd nQW the Money Due account is debited 

^^^^sT^l^ and the Money .n Transit account is credited $150 

«^SZ£££* to an .ssuing Bank ^ ^^^.^3 0^0^ 

account to be debited . by l^^^ZZZy Generator Modu.e 6 and the Correspondent 
At the Issuing ^"^"l^^J^^ Money Issued account gets a S150 credit (Step 4 
Bank Money account gets a $15 ^^ ne 7' e en t ^ ated * Money Generator Module 6 ($150) gets 
Z%2t ^3^0^ fvirr lling Bank /and Correspondent Bank 2 Teller 

5 i«a« counting ^^^na-jo = 1. 

Issuing account by $100 (Step 1- 2) 1 Tel|er mQney mo(ju|e g , 0 fte 

Transaction money module 4 via the Issuing Bank's 1 Teller money modu.e 5 (Steps 3 4). 

Fi g r 15 il, f ates ^ 
I^Jh c^ fhel^ing Band's 1 Te..er money module 5 wi.. cau* > the Issuing 

Knk's ! Foreign Ixch'ange account to be credited by £60, while its Money Due account would be debited 
h «inn Slo 11 Here the $100 is transferred from the Transaction money module 4 to the Teller money 
m'odT 5 Xch SenVequeTt^ an electronic note 11 representing £60 be created by the Money 
Generator moduto « ^Step ^ & ^ ^ ^ ^ fcy £6Q Mon 

I * riL L £60 The £60 electronic note 11 created by the Money Generator module 6 is 
^sferr^d to te TelS money^odde 5 which now stores both the $100 and the £60 (Step 3). The £60 is 
Z ^S^t^ *r3L money module 5 to the Transaction money module 4 resulting m a net 
jLST^irTth. Transaction money modu.e 4 and $100 remaining in the Teller money modu.e 5, 

45 ^ZZ^rSZes for a foreign exchange of $100 for £60 at a Correspondent Bank 2 are 
showJln 16 Th'e Transaction money modu.e 4, in this examp.e, requests that 
"Du^ase" £60 from the Correspondent Bank's Teller money modu.e 5, wh.ch causes the ^respondent 
BanX Foreign Exchange account to be credited by £60 whi.e its Money Due account .s debited by $ 00 

so fsTep 1) The $100 stored in the Transaction money module 4 is transferred to the Correspondent Bank s 2 
Kr money modu.e 5. which sends a request to the Issuing Bank's 1 Teller money modu.e 5 to withdraw 
IS arTd debits its Foreign Exchange account by £60 and credits its Deposited at .ssu.ng Bank account by 

^T^Lponding account transaction at the .ssuing Bank 1 debits the Correspondent Bank Money 
55 account S £60 and credits the Money .ssued account by £60 (Step 3). The Issumg ^* money 
module 5 then requests that the Money Generator module 6 create £60 and transfer rt to the Issuing Bank s 
TeTer money module 5. which in turn transfers it to the Correspondent Bank's 2 Teller money modu.e 5 - 
Seps 4- 5) From there, the £60 note 11 is transferred to the Transaction money modu.e 4. leaving ,t w,th 
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balance of £60 while the Correspondent Bank's 2 Teller money module 5 finishes with a balance of $100 

(Step 6). , 
The accounting transactions for a withdrawal or deposit of credit notes 11 also involve several 
accounting operations, as shown in Figure 17. When a subscriber wishes to withdraw money from his/her 
5 credit line (Step 1), the proper credit note 11 is simply transferred from the Money Generator module 6 to 
the Transaction money module 4, reducing the customer's credit line by an equal amount to the amount 
transferred (Steps 2-4). 

Alternatively, when credit notes 11 are deposited by a subscriber's Transaction money module 4, the 
subscriber's account is increased by the amount deposited, and the Money Due account is debited by an 

w equal amount (Step 1). 

The accounting operations involving the Issuing Bank's 1 receipt of cleared electronic money will now 
be described. Referring to Figure 18, in this example $100 of electronic money and $100 of credit notes 11 
have been cleared by the Clearing Bank 3 to settle the balances among several Issuing Banks 1. The $100 
of electronic money and the $100 of credit notes are transferred to the proper Issuing Bank 1 (Step 1). 

75 Additionally, $50 of electronic notes 11 that it has issued are also deposited at the Issuing Bank 1. 
Consequently, the Issuing Bank 1 will debit the subscriber's account A by $100, debit the issuing Bank's 
Money Issued account by $150, credit the Money Due Account by $50 and credit the Issuing Bank's 
Deposited at Clearing Bank account by $200 to complete the transaction. 

Turning now to Fig. 19, an accounting example of an exchange of cash for electronic notes 11 at an 

20 Issuing Bank 1 is shown. In this example, the subscriber wishes to exchange $50 of cash for $50 of 
electronic notes 11 to add to the $100 of electronic notes 11 already stored in his/her Transaction money 
module 4. 

In the first transaction, the $50 of cash is deposited at the Issuing Bank 1 which causes the Money In 
Transit account to be credited by $50, while the cash account is debited by $50 (Step 1). 
25 Next, the $100 of electronic notes 11 in the Transaction money module 4 is removed, resulting in the 
Money In Transit account being credited by $100, while the Money Due account is debited by $100 (Step 
2). 

The Teller money module 5 will now request $150 of electronic notes 11 from the Money Generator 
module 6 to return $150 of electronic notes 11 to the subscriber (Step 3). Accordingly, the Money In Transit 

30 account is debited by $150 while the Money Issued account is credited by $150. 

The newly generated $150 of electronic notes 11 is then transferred from the Money Generator module 
6 to the Teller money module 5, who in turn transfers the $150 to the subscriber's Transaction money 
module 4 (Step 4-5). The completed transaction leaves the subscriber with $150 of electronic notes 11 and 
the Issuing Bank's Cash account containing a $50 balance. 

35 Also shown parenthetically in Fig. 19 is the case when the subscriber exchanges $50 of cash for 
electronic notes 11 when there is a zero balance in his/her Transaction money module 4. In Step 1, the $50 
of cash is deposited at the Issuing Bank 1 which causes the Money In Transit account to be credited by 
$50, while the cash account is debited by $50. Since no notes 11 are removed, no accounting is performed 
in Step 2. 

40 In Step 3, only $50 is requested from the Money Generator module 6, and the Money In Transit 
account is debited by $50 while the Money Issued account is credited by $50. The same transfer between 
money modules occurs as in Steps 4-5 of Fig. 19 described above, using only the $50 that was requested. 
This would leave the subscriber with $50 of electronic notes 11 in lieu of his original $50 of paper money. 
In Fig. 20, an exchange of cash for electronic notes 11 at a Correspondent Bank 2 is shown. This. 

45 example uses the same parameters as in Figure 19, namely, the subscriber has $50 of cash and $100 of 
electronic notes 11 in his Transaction money module 4. 

When the $50 in cash is deposited to the Correspondent Bank 2, its Money In Transit account is 
credited $50 while its Cash account is debited $50 (Step 1). The $100 of electronic notes 11 is then 
transferred from the Transaction money module 4 to the Correspondent Bank 2 which credits its Money In 

so Transit account by $100 and debits its Money Due account by $100 (Step 2). 

From there, the $100 of electronic notes 11 is deposited at the Issuing Bank 1, wherein its Money Due 
account is debited by $100 while its Correspondent Bank Money account is credited by $100 (Step 3). At 
the Correspondent Bank 2, the Deposited at Issuing Bank account is debited by $100 while the Money Due 
account is credited by $100. 

55 A withdrawal request is then made by the Correspondent Bank 2 for $150 from the Issuing Bank 1 (Step 
4). This request results in the Correspondent Bank 2 debiting its Money In Transit account by $150 and 
crediting its Deposited at Issuing Bank account by $150. 
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H-nnu, thP issuina Bank 1 Teller money module 5 requests $150 of notes 11 from the Money 
e-STSSS t rJtsTcoTeUndent Bank Lney account by $150 and credits Its Money Issued 

3CC FnllW ?he 50 $l1o e of electronic notes 11 is transferred from the Money Generator modu.e 6 to the Issuing 
■ BaJ * : IMller ^moVey module 5 which transfers it to the Transact^ money module 4 after pass.ng 

moduli ato shown in Fig. 20. As in the first case, the $50 in cash is deposited £ ^respondent 
Bank 2 its Money In Transit account is credited $50 while its Cash account ,s deb.ted $50 (Step 1). 
, 0 A $50 withdrawal request is then made to the Issuing Bank 1. and the Money In Trans.t account is 
* H h««so while the Deposited at Issuing Bank account is credited $50 (Step 4, parenthetical entry), 
xtreafte' t£ Tl^tte^TL Money Lb Module 6, the Correspondent Bank Money account 
I lbTed $50 and tSrmoney issued account is credited $50 in Step 5 (parenthetical entry). Here, $50 m 
Sectrol notes are tTansLed through the same money modu.e path as Steps 6-8 above, to reach the 

15 "^STZZZZ exchange of electronic notes 11 for cash at an ^^^sX 
subscriber has $100 of electronic notes 11 stored in his/her Transacts money module 4 and w.shes to 

JZ LI \ M <R100 of the electronic notes 11 is removed from the Transaction money module 4 - 
7^r^sll^l^ "it account to be credited by $100 and the Money Due account (at 

^^^^^t^'r^ *0 of updated electronic notes 11 frorr .the Money 
Genl^or modure and this transaction requires the Money In Transit account to be debrted by $50 anc 
account to be credited by $50 (Step 2). The newly generated $50 of electron, ^notes 11 
s then transferred to the Transaction money modu.e 4 through the TeHer monev . module 5. The $50 of 
oaoer cash is then transferred to the subscriber through a Teller or ATM (Steps 3-5). 
P Also shown in this figure (parenthetically) is the subscriber making the same exchange for cash when 
on.yTsO fs stored in hta/tar Transaction Money Modu.e 4. At the Issuing Bank, $50 of ^^^V^ 
remold for which the Money In Transit account is credited $50 and the Money ^^VT^ 
$50 Fifty dollars of paper cash is then returned to the subscnber s.nce he/she only deposited $50 of 

"'Tomp^g 5 tVis transaction, in both cases the Money In Transit account is debited by $50 while the 
cash acTount at *e ssuing Bank 1 is credited by $50. The net result is that the subscnber ends up with 
So ofpaper cthand. in the former case only. $50 of updated electronic notes 11 ,n h.s/her Transact.cn 

m ° n Th y eTxct e nge of electronic notes 11 for paper cash at a Correspondent Bank 2 is 

22 As in the example illustrated in Figure 21. although the subscriber is only exchanging $50 of electromc 

notetVl alf$100 of electronic notes 11 are transferred from the subscriber's Transaction money modu.e 4 

"° <Ste After the notes 11 are transferred, the Correspondent Bank's 2 Teller money module 5 credits its 
Monef n T^ansTaccoun by $100 and debits its Money Due account by $100. This $100 of electron* 
SEMI is ^deposited a/an Issuing Bank 1. causing the Correspondent Bank 2 to credit its Money Due 

account bv $100 while debiting its Deposited at Issuing Bank account by $100 (Step 2). 

account by $100 9 ^ tQ ^ Bank Money acc0 unt while $100 .s 

debiSd to the Money Due account. The Correspondent Bank 2 now makes a request to wrthdraw $50 o 
"notes 11 from the issuing Bank 1 (Step 3). Consequently, the Deposited at Issuing Bank account 
is credited by $50 while the Money In Transit account at the Correspondent Bank 2 k debrted by $50. 

Sow. the issuing Bank's 1 Teller money modu.e 5 request $50 from the Money Generator module 6 and 
so debits its Correspondent Bank Money account by $50 while crediting its Money Issued account by $50 
Step 4) The $50 of updated electronic notes 11 is transferred from the Money Generator module 6 th ough 
issuing Bank 1 Teller money modu.e 5 and the Correspondent Bank 2 Teller money module 5, back to the 
Transaction money module 4 in Steps 5-7. „ (W «u ;«= 

Also illustrated is this same example with only $50 stored in the Transaction money modu e 4 which s 
ss deposited at a Correspondent Bank 2. to be exchanged for paper money. For th.s deposit the Money In 
Ssit^unt is credited $50, and the Money Due account is debited $50 (Step 1). The $50 is . then 
deposited by the Correspondent Bank 2 to its account at the Issuing Bank 1. At the Correspondent Bank £ 
the Money Due account receives a $50 credit, while the Deposited at Issuing Bank account rece.ves a $50 
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debit. On the Issuing Bank 1 side, it credits the Correspondent Bank Money account by $50 and debits the 
Honey Due account by $50 after receiving the $50 deposit (Step 2). 

In both illustrations, fifty dollars of paper cash is then transferred from the Correspondent Bank 2 to the 
subscriber, while the Correspondent Bank 2 debits its Money In Transit account by $50 and credits its cash 
5 account by $50 (Step 8). The subscriber is now left with $50 of paper cash and, in the first illustration, $50 
of electronic notes 11 stored in his/her Transaction money module 4. 

Figure 23, the accounting process for clearing the electronics money issued by different Issu.ng Banks 
is shown. This illustration uses an example in which $100 of electronic notes 11 issued by Bank B has been 
deposited at Issuing Bank A, and $150 of electronic notes 11 issued by Bank A have been deposited at 

w ,ssu, | ^ e ank i B |ssu . ng Bank A transferg the $100 jssued by Bank B to the clearing Bank 3. It then credits its 
Money Due account and $100 and debits its Deposited at Clearing Bank account by the same amount In 
Step 2 Issuing Bank B deposits the $150 of Issuing Bank A's money at the Clearing Bank 3. Its Money Due 
account is credited by $150, while its Deposited at Clearing Bank account is debited $150. 

J5 In sum, $50 is due to Bank B. Accordingly, $50 gets debited to the Clearing account of Bank A, wh.le 
$50 gets credited to the Clearing account of Bank B (Step 3). _ 

In Figure 24, the accounting transactions corresponding to updating electronic notes 11 is shown. Here, 
$100 of electronic notes 11 are stored in a Transaction money module 4 and are transferred to an Issuing 
Bank 1. where $100 is credited to the Money In Transit account and $100 is debited to the Money Due 

account (Step^V ^ electronic notes 11 are requested from the Money Generator module 6 causing 

the Money In Transit account to be debited by $100 while the Money Issued account is credLted I by $100 
(Step 2) With this accomplished, the $100 of electronic notes 11 is transferred from the Money Generator 
module 6 to the Issuing Bank's 1 Teller money module 5. which in turn transfers the money to the 
25 subscriber's Transaction money module 4 (Steps 3 - 4). 

Reconciliation and Clearing Systems 

Referring to Figure 25, the Transaction Reconciliation System 22 is shown. It will be understood that the 
3 o Teller money modules 5, the Money Generator modules 6 and the banking system 20 may periodically 
pass transaction records to a Transaction Reconciliation System 22 maintained at each partic.pating bank. 
These transactions will be analyzed and matched to determine if there is any faulty process occurring in the 

system 20 of the invention. 

The Transaction Reconciliation System 22, which may be embodied in any appropriately sized and 
suitably programmed general purpose computer but is not so limited, will ensure that all Teller money 
module 5 transactions with a financial impact, e.g., deposits, and withdrawals and payments, match the 
appropriate accounting transactions. Any mismatches could indicate incomplete transactions or poss.ble 
fraudulent actions. 

Transactions reflecting the money issued by the Money Generator modules 6 also should correspond to 
Teller money module 5 transactions and have the appropriate accounting transact.ons recorded. Any 
mismatched data may indicate incomplete processing or a security breach. Unmatched accounting 
transactions may be caused by incomplete transactions or an attempt to tamper with the records of the 

banking system 20. „» 

In the preferred embodiment, these unmatched transactions may then be transferred to an investigation 
system 12 where the causes of the problems may be determined. On-line dialogues may be provided to 
allow investigators to review the mismatches against transaction records and to determine appropnate 
actions to correct the situation. Investigators may then take corrective actions by adjusting accounts 
deactivating faulty Teller money modules 5 and Money Generator modules 6, and notifying subscribers of 

the actions. c . ... . .. 

Attention is now directed to Figure 26, which illustrates the clearing process for handling deposit 
transactions. Correspondent Banks are not involved in this process because subscriber deposits are 
deposited to their accounts at Issuing Banks 1 on a real-time basis. At Issuing Banks .deposits are 
aggregated by the Clearing System 13 to consolidate all deposited electronic money (including the deposits 
from Correspondent Banks) for transmission to the Clearing Bank 3. 

The Clearing Bank 3 may be implemented in any computer processing facility capable of accom 
modating the large number of transactions and corresponding amounts of data which the system will 
typically handle. A high volume mainframe computer, a suitably sized minicomputer system, a number of 
networked work stations having the necessary data processing capabilities or combination of the foregoing 
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may a.so be used. As wi>. be appreciated by a person skiUed in the art. me particu.ar design ct the Cearing 
Bank 3 hardware system is not critical to the ,n ^° n - , procedures . In one of these 

lt is anticipated that .ssuing Banks 1 may* «_^n one £j££P i ^ ^ c , earjng BanR 3 . 

procedures, electronic 7^ n ^_ J^^^ton. are actually occurring. Aiternatively, an 
5 Sl^C "e deTl rations being pe.or.ed d.ing the course of the day for ,ater 

batch processing. Interbank processing could <f^™£££ ^ jts electronic money to a deposit 
As shown in Figure 26, an .Issuing Bank 1 may p 8 transmitted t0 the Clearing Bank 3. 
I0 ^TrZ^Z Transaction Beconci.iation system 22 for 

by the monetary unit for each Issumg Banks 1 demand ac ° oun \ Drocesses Any accoun ts which are 

„ ssr J rr„ «rr rxs » jl**, - * - 

industry- ... ^ : „ ~~ rt + honk tn the Monev Issued Reconciliation 

SystTm* K=£ ISMS EJT^^ reconcSed and ch/cked for tampering and 

^Sitiona, statistica, ^^^^^S^^ ^^^^ 
SK"il B J!S ^ cl S pute P r but not so limited, for matching the electronic money 

^ r and electronic money deposited at issuing 

As indicated in Figure 27, the electronic m °™y conveyed to the Money Issued 

Banks 1, and money cleared transactions receded from clearing bank 3 a ^^ e ° transactions 
Reconciiiation system 23. The Honey Issued Addition^, the Money 

25 =aT ^ — — - — but 

which was not issued or was possibly ""f^J^T.^ Investigators may then determine 

SSSShSno Bank 1 1n order to assess the risk of interbank settlement problems. 
Op erational Sequences 

a^ociated Teller money module 5 applications are hereinafter designated with a C . 

■"SJrSB to steps in another figure are indicated by a pentagonal tag hav.ng an 
^U^Ts^T^Tco^Jo. the other figure with a circ.e having the same a>phanumenc symbol 
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Withdrawal From An Issuing Bank 

In Figures 28-35A, a process flowchart of a transaction between a Transaction money module 4 and 
an Teller money module 5 is shown. In this process example, it is assumed that the subscriber is desirous 
5 of completing a monetary transaction with a participating bank; specifically, a withdrawal of some amount of 
electronic money from his/her account, to be stored in his/her Transaction money module 4. 

The process flow to set up a withdrawal transaction begins at the top of Figure 28. The first flow bock is 
a withdrawal set up between a money module A and a bank's Teller money module B 5, which is described 
further in Figure 29. This process begins with money module A performing a sign -on process that is also 
w described in further detail in another figure, specifically Figure 31 . 

Subscriber Sign - On 

Referring to the top of Figure 31, the subscriber prompts his/her Transaction money module 4 to 
75 perform a sign -on function (Step 10). The Session Manager 31 application receives the sign -on message 
(Step 12) and checks to see if the Transaction money module 4 has inhibited subscribers from signing on 
(Step 14). 

Subscriber sign -on may be inhibited if a user makes several unsuccessful attempts to sign -on to the 
Transaction money module 4. For example, the allowable attempts to sign -on may be limited to three, 

20 such that if a person makes more than three consecutive unsuccessful attempts to sign -on to the 
Transaction money module 4, the Session Manager 31 will prohibit any further sign -on attempts. 
Additionally, this "lock-out" feature may be maintained for any predetermined time period, such as 
twenty -four hours, for example. Such an arrangement will provide security from persons who come into 
possession of the Transaction money module 4 but who are not properly authorized to access it. It should 

25 be noted that while this type of an arrangement is anticipated in the preferred embodiment of the invention, 
the invention should not be limited as such, since any of the methods known in the industry for providing 
security from unauthorized persons would be suitable for use herein. 

When the sign -on is not inhibited, as will typically be the case, To Subscriber 33 prompts the 
subscriber to enter his/his sign -on characteristics, such as his/her PIN and biometric identifiers (Step 22). 

30 Inputs from the subscriber are forwarded through the Session Manager 31 to the To Subscriber 33 
application (Steps 24-28), which responds to the characteristics entered and entitles the subscriber to 
operate the Transaction money module 4 if the subscriber's identification characteristics are the correct 
ones when compared to those stored in the memory of the Transaction money module 4 (Steps 30-32). 
If the subscriber's identification characteristics do not match the identifiers stored in memory, the To 

35 Subscriber 33 application notifies the subscriber of the invalid sign - on condition (Step 34). From there, the 
To Subscriber 33 application checks to see how many times the user has attempted to sign -on (Step 
36), and if the predetermined count has not been reached, the Session Manager 31 is notified (Step 38). 

The Session Manager 31 works in conjunction with the Clock/Timer 43 application to set and to monitor 
the time that has elapsed between unsuccessful sign -on attempts (Step 40). In one embodiment, too many 

40 unsuccessful attempts within the set time period will cause the Session Manager 31 to prohibit any further 
sign -on attempts, effectively shutting down the Transaction money module 4. The Session Manager 31 
notes that the sign on is terminated in Step 42. 

Turning back to Step 14 of Figure 31, assuming that the Transaction money module 4 is inhibited, the 
Session Manager 31 checks to see if the predetermined time period has expired (Step 16). If the 

45 Transaction money module 4 is still in the prohibited sign -on mode, the To Subscriber 33 sends a 
message to the subscriber that further access to the Transaction money module 4 is prohibited (Steps 18- 
20). The Session Manager 31 notes that the sign - on attempt is terminated, again in step 42. 

Setup Withdrawal 

50 

Turning to Figure 29, when a proper sign -on is accomplished, the To Subscriber A 33 prompts the 
subscriber for the type of transaction that is desired (Step 43). As mentioned previously, it is anticipated 
that a subscriber may transact with any one of a multitude of accounts at several different participating 
banks and financial institutions. 
55 After selecting the particular bank and account (Step 44), the Transaction money module 4 initiates a 
procedure for communicating with the bank that was selected, by engaging the Network 25. The overall 
program flow now passes to the procedures illustrated by flowcharts in Figure 33. In Figure 33, there is 
shown the data processing and flow for implementing a sign -on to the Network 25. 

26 

BNSDOCID: <EP 054229BA2_I_> 



EP 0 542 298 A2 



20 



25 



Network Sign - on 

ThP illustrative Network 25 sign -on method about to be described is in general applicable to any of the 
a^^^^^ ™**«m.nt. Thus, in this example, "A" denotes any Cass of money 

5 module. ar . MW \ ;<= ^ipcted the money module initiates communication with the 

ir:^ 2^™ s^p 

, 0 £ S^S— I ffi^™'* the Network Server 2 S (Step 53, which, upon receipt, 

routes it to ^.^J^Z^S^SL^ to check its validity (Step 62-64), and if it is not valid for 
the Secu^W slrlef 2 7 will Snal the Network Server 26 to deny access (Step 66). The Network 
lZ^£^^J^-*«™ "essage to Session Manager A of the Transaction money 

15 m ° d « the fessio? Manager A that receives the denied access message is a Transaction money module 4. 

EiT r^l -S* A 37 W »ca«on. w*c„ - valid** « ">V 

money module 4 (Steps ^ ; 90). °; a ~ ^ al| money modu , es will check the validity of a 
XnTure m0 recSv e 5 d uTZ £ S-TsJLr 27* This he, P s to ensure the integrity of the overall 

^Tthe case of a valid signature, Maintain Security A updates the bad money module list . and the 
In the case or a a recertified or the certificate has exp.red (Steps 96 

S^^Sn^SX A ineSeTa new certificate (Step 126 of Figure 33C) while Pub.ic Key A 
nSerftes new^ey* and I S the certificate using the old public key (Step 128). Session Manager A sends 
V^S^X^S^ Server 27 who takes the certificate and tests the validity of the signature 

(St Tssumi"ng 3 that the signature of the new certificate is not valid at this stage, Steps 66 - 76, Fig. 33, are 

J 1 1 rimTft back to the money module (Step 138). Session Manager A 31 receives the new 
cert S Step Fig Lo, nd forwards it to its Maintain Security application A to again va.ida»e *• 
ceSicaS^hrough use oT the Public Key application (Steps 142-146). Here, the money modu.es will repeat 
ST^oMr^Wty of the certificate issued from the Security Server 27 For ^f'd signature the 
Session Manager A 31 sends an acknowledgment to the Security Server 27 (Step 148) who responds by 

module proves to be invalid Fig. 33D, Session Manager A will send an inva.id certificate ™ssagealong 
« certificate back to the lecurity Server 27 (Step 150), which will again attemp to vahdate me 
! fha ^rtifi^^ fstpn 152> A valid signature will return the process to Step 66, Fig. M. 

A^nSe Z STS? wil^s^th: Security Server 27 to disconnect from ™j 25 (Step 
156 Fig 33D) and cause the Network Server 26 to notify the money module of a malfunction (Step 158). 

The S^s on Manager A that receives the message (Step 160) will, in the case of a Transaction money 
aJ£!7Z^TSZ«X* A 33 to inquire of the subscriber if they desire to retry the whole process 
owning on to the Network 25 (Step ,64 » 168). In the case of .Tatar ^™-*« l^STS 
Generator Module 6. the To Bank application A will inquire if there is a request to retry the Network 25 

^^^ZTZ^~ - - —cation link ■* ^^^S^ 
a request for retry of Network 25 access will return the procedure back to Step 56. Fig. 33, wherein 
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Maintain Security A will again retrieve the Transaction money module's certificate for the Network Server 
26. 

Back at Step 98, Fig. 33A if the certificate does not need to be recertified or has not expired, Session 
Manager A 31 will request the date and time (Step 100) from Clock/Timer A (Step 102, Fig. 33B), and 
5 forward this data to the Network Server 26 (Step 1 04). 

The Network Server 26 checks the time and date after receiving it (Step 106) and if it is outside of an 
acceptable predetermined parameter, the Network Server 26 will send the new time and date (Step 110) to 
Clock/Timer A through Session Manager A (Steps 112 & 114). If Clock/Timer A 43 cannot adjust the date 
and time to be synchronized with the Network 25, the operator of the money module for subscriber or the 
w bank is notified of the clock malfunction (Step 116-124). 

In response to the apparent malfunction, the operator may attempt to have the time and date resent 
from the Network Server 26, Step 124, and the procedure reverts back to Step 102 in which it attempts to 
send the new date and time to the money module. Alternatively, an acceptable date and time check, Step 
108 allows the Network Server 26 and Session Manager A to exchange acknowledgements and note the 
15 successful Network 25 sign - on (Step 126- 128). 

Establishing A Session 

As shown in Figure 29, after the steps of money module Sign - on, transaction selection and network 
20 sign -on are completed, sessions are established between the money modules. Figure 34 diagrams the 
flow process for establishing a money -module to money -module session, which, as will be understood by 
one skilled in the art, will in general be applicable as well to other sessions established between the various 
types of money modules of the present invention. 

Referring to the top of Figure 34, the Session Manager A will first check to see if the subscriber has 
25 requested connection to a specific destination in the Network 25. (Step 190). For instance, where a 
subscriber is desirous of transacting with his/her account at a specific bank, the Network 25 will connect the 
Transaction money module 4 to the selected bank, Steps 192-198. Conversely, when a subscriber is 
performing updating functions on the Network 25, there is no need to establish a session with any specific 
bank, and the Network server 26 may decide where to route the connection, based on Network 25 traffic. 
30 If a specific destination has been selected by the subscriber, Session Manager A conveys the 
destination information to the Network Server 26 (Step 194). The Network Server 26 initiates a commu- 
nication link to the money module of the selected destination (Step 196) and sends an acknowledgement to 
Session Manager A 31. 

After receiving the acknowledgement that the destination money module has been contacted (Step 
35 198), the Maintain Security application A will send its certificate to the Maintain Security application B 
through each application's respective Session Manager (Steps 200 - 206). 

It is anticipated that the money modules will exchange certificates to verify that each money module is 
interacting with another valid money module. To this end (as seen in Fig. 34A), the Public Key application B 
44 tests the certificate of money module A by using the public key algorithm and the public key 
40 corresponding to the private key used by money module A, to encrypt and check A's certificate and verify 
that it is valid (Step 208). 

If the certificate is found invalid, the session Manager B will note the session is terminated (Step 210). 
In the case of a Transaction money module 4, the To Subscriber B informs the subscriber of the transaction 
termination (Setup 212). Likewise, a Teller money module 5 of Money Generator Module 6, uses the To 

45 Bank application B 47 to notify the bank of the termination, Step 213. It is anticipated that the counterparty 
money module will then timeout to end the exchange. 

In Step 214, Fig. 34A, assuming that the certificate of money module A is valid, the Maintain Security 
application B 37 checks to see if Transaction money module A is on the list of compromised money 
modules (Step 213). If money module A is on that list, the process flow returns to Step 210 so that the 

so communications can be terminated. 

Alternatively, when money module A is not on the list of compromised money modules, then Random 
Number Generator B 46 creates a session key (Step 216) and encodes the session key along with money 
module B's certificate and a verification message, using money module A's public key (Step 218). This 
encoded message is sent to money module A by Session Manager B 31 (Step 220). 

55 Session Manager A 31 receives the message from money module B (Step 222), and uses its Public 
Key 44 algorithms application to decode the message (Step 224, Fig. 34B), and to verify money module B's 
certificate (Step 226). 
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m ~H,,i* fvq rprtifirate is invalid the operation branches to an "abort 

if the * st ss^C^^ a session (s,eps 5o °- 5z " ) This 

transacts" P^dure to termm^e the tep communication session and t0 functionally shut off money 
SSK SZh» s^n^^ation ,ink ending. (Steps 500-5,4. Figure 32). 

Abort Transaction 

_ * =• „ -^9 thP functional shut -off of a money module through the abort transaction 
Branching to Rgure 32 the tunc ,onal shut ° * ess be used wneri 

process wi,. now, ^^^^jlX^S-Son. occurring between them. Accordingly. 
ST mo°ne m y S be desTgn^ted "X" and ^ to illustrate the generic applicability of the process 

changes tE7^ LdeTthT rnoney modu.e (Step 500). and then noting that the sess.on has been 
3b °tthf ca P se 5 where the money modu.e that is initiating the termination is a Transaction money -module 4, 



40 

234). 



234 Qu m m^ri C Kev A 45 then encrypts the verification message with the date and time information using 

the SSTioney module B (Step 250). .f the discrepancy between the two clocks ,s greater than a 
redetermined amount, the session will be aborted by branching to Steps 500 - 524. 

if Ze t^ ^ no discrepancy that is greater than the permissib.e amount. Session Manager B 31 w.N note 
its start o7a session 'step 252). and send an acknowledgement to money modu.e A to start the *ansact on 
%tl 2sl Arte? me encoded message is sent from money module B to Session Manager A 31 usng 
55 SS^^TlCSi-on Manager A 31 acknow.edges the message receipt and also notes the 
start of session (Steps 256 - 258). 
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Request Withdrawal 

After a session is established between the Transaction money module 4 ^ J^^T mo*toJ 

to the Teller money module 5 (Step 700). To send this request, the process Steps 2 8 are repeated, 
whSthe message's encrypted using the previously described cryptograph* techn.ques. 

Validate Account Number 

Once the withdrawa. request and the account number ^.^S^^^ ^ 
module 5, a procedure to validate the account number is initiated (Steps 7041 7055). A flow a.ag 

prof e SsgnaLre :an^conveys them I L Pub,ic Key application 44 to ve^ 

7041 -7042) The signature is tested using the public key generated and distributed by the Bank s Security 
SeJer 27 An inva'd signature causes the Maintain Security 37 application to inform the Sess.on Manager 
tha7L Lount profi.e is invalid (Step 7044), whereby Steps 500-524, Fig. 32. are fo.lowed to abort the 

transaction between the two money modules. . annlication 47 

If the signature test confirms a valid signature, the procedure advances to the To Ben ^JJ> £7 

ssrss xrr^s sss zxrs^i arss 

" * TSTSSTp^i'^ld » b. .ecert-ied, « M.intti„ S«*h» application 37 » »nd t h. 

tne accourR ^' um J u c ^,^ o T /pin -*RA SteDS 7051 -7052), when will recertify the account 
^T^^^^ZZ -n Jonse. the TeHer money moduie 5 

^*JZS2XT?£ — s the prev^y 

aJ^oZeT^r* messages, Steps 2-8. The Maintain Security application 37 then vkttto 
account oSTn the money module and returns an acknowledgement to the Maintain Security appl-cation 
3 7 Tn Se belter money module 5 (Step 7055), also using Steps 2-8. The electronic message is received 
by L M» SecurUy application 37 of the Teller money modu.e 5 and acknowledged »" Stop TOM. 

With the account information checked, the process returns to Step 704 of F.gure 30. The To Bank 
appfication 47 now verifies that there are sufficient funds to support the withdrawal reques (Step 70£ 
luEnt funds will prompt the return of an acknowledgement to a Transaction money 
process Steps 2-8 to transmit the acknowledgement to its To Teller 34 appl.cat.on funct.on (Steps 706 
714^ In the case of a Teller money module 5, no acknowledgement is required.. 

to th , cS o a Transaction money modu.e 4, an insufficient amount of funds ^« *^"JJ^ 
to be prompted to enter a new amount for the withdrawal (Steps 718-720. Figure 30A). As shown by Step 
724 the newly entered amount causes the To Teller application 34 to send the new request to the To Bank 
wiicaSoTI? (using Steps 2-8) of the Teller money modu.e 5 to verify if there are sufficient funds to 
cov'er the Jlst requested" amount, returning to Step 704 of F*. 30 ; If the new Request ,s stN. = t 
the funds on balance at the bank, the Teller money module 5 w,l. m.tiate Steps 500 524 _ to abort the 
transaction between the to money modules. In the case of a Teller money module 5. the transaction ,s 
allowed to overdraw the account. 
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Transfer Notes 



I Referring back to Figure 29. To Teller A 34 transfers the total of its currency notes 11 to the Jeter 

money module 5 (Step 45). If there are no notes 11 being he.d in the Transaction money - 
time the withdrawa. request is made, the To TeHer A application 34 sends a message to the Teller money 
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Electron. ^^^^^SJ^e,^^ 39 of the transfer or money module chooses the 
(referring now to Figure 39). The Note w application 40 create a transfer for 

ZZSSiSSfZZlXS* Ui. app.ica.on 41, Jjr 9 * no,. 11 «. 
signatures Mo . pad*, to be sen. B th< ' "»7«^ f ™"7 0 n™c no» 11 B « Pacta. Manager application 

^ ™-H=~ ^ ~- ~ 

11 that should be ^ <f^ P T.^^^ the transac tion between the two money modules to be aborted, using 

^ ™ the sessions to be aborted 

using the P^^^^^^ 2 ; fn ttfcase where a Teller money module 5 is accepting 
Assuming the notes 11 have n * * ^ ™ |n tnis St ep, the Public Key Y application 44 verifies 

them the process flow resumes at Step 765, t-ig. da/v in mis oie^, » 

is updated with the new note , locatic "^^f^J^ the electronic notes 11 have been transferred 

transacts are ^ ^ ^ ei^ 'ha^ e^ tSiSd from th'e mUy modu.e^nd 

application B 47. Both in he cas ^ he " n ° St 776, a session is established between the Teller 

"2™^ B u P sing the procedure outlined above in Steps 190- 

258 ^^0^' "^requested to satisfy the withdrawal, an account postin g oc^s to reflect me request 
The To Bank application B 47 will post the proper accounts transactions (Step 778. F,g. 28) as also 
illustrated in Figure 14, Step 2. 

Request Notes 

Directing attention to Figure 40, notes 11 may be requested between Teller money modules 5 and 

SZ^S^ tL the ^Creator application 50 may be activated (Step 784) to create the 

^jrS^eSlonte notes 11. they are signed by the Public Key app**|on ■ M Momy 

~ T a u a /Q +or , 7Qft\ and nlaced in a holder by its Notes application 40 (Step 790). Finally, tne 

modute B 5 to the Transaction money module 4 using these same process Steps 750 770 for 

"^'tfZlZ^^ *» withdrawal of e,ectronic notes 11. the money ^es will 
"commSo or finalize the transaction by utilizing the following procedure. Referring now 
detaTd description of this process, the Tran Log Mgr. application 36 updates its Tran Log to , recorc I the 
aeiaiiec ohm . v JL, above , Step 690 ). When it is a Transaction money module 4 that is 

module it is transacting with. 
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With this end of session notice received, the other money module, in this example a Teller money 
module 5, will use its Tran Log Mgr. application 36 to update its own Tran Log (Step 694). Assuming, 
however, the second money module receiving the end of session notice is not a Teller money module 5, an 
additional step of having the To Subscriber application 33 notify the subscriber of the end of the transaction 

s occurrence (Step 696) will be necessary. Thereafter, the Session Manager 31 of the second money module 
in both cases will also make note of the end of the session (Step 698). 

Directing attention back to Figure 28, the process to commit is initiated first by the Transaction money 
module 4 committing its transaction with the Teller money module B 5 (Steps 690-698). The process steps 
are also applied to commit the transaction between Teller money module B 5 and the Money Generator 

w module 6 (Steps 690-698). That completes the processing for one complete withdrawal of electronic 
money from an Issuing Bank 1. 

Withdrawal From A Correspondent Bank 

A withdrawal from a Correspondent Bank 2 will now be described, aided by reference to Figure 35. To 
begin, the previously described Steps 43-48 to set up a withdrawal are undertaken by a Transaction 
money module A 4, in conjunction with an Teller money module B 5. Next, Steps 190-258, used to 
establish a session, also described above, are initiated between Teller money module B 5 and Teller money 
module C 5. After the sessions have been established, the To Bank application B 47 will post the 
20 accounting transaction corresponding to the withdrawal that is going to subsequently occur (Step 900; see 
also Fig. 13, Step 1). 

As previously noted, it is contemplated that whenever a Transaction money module 4 interacts with a 
bank, both Issuing 1 and Correspondent 2, all electronic notes 11 that are stored within the Transaction 
money module 4 are removed and replaced with electronic notes 11 containing the most recent certificate. 

25 To perform this operation, To Transaction B 49 will check to see if there are notes 11 stored within the 
Transaction money module 4 (Steps 902-904). If there are notes 11. To Bank B 47 will post the 
appropriate accounting transactions (see accounting procedure illustrated in Figure 13; Step 2) (Step 906), 
and perform a deposit request from the Teller money module C 5 (associated with an Issuing Bank 1) to 
return the notes 11 that need to be replaced. 

30 For a detailed description for performing a deposit request, attention will be directed to Figure 44. Here, 
the To Teller application 34 sends a deposit request message, the amount of the deposit to be sent, the 
account number and the account profile of the account to which the notes 11 will be deposited (Step 920). 
This information is transferred to the Teller money module 5 using Steps 2-8 for sending messages, and 
then Steps 7041 -7050 (see Figure 38) are performed to validate the account profile and number. 

35 In the case where the depositor is a Transaction money module 4, the To Transaction application 49 of 
the Teller money module 5 will send an acknowledgement to the Transaction money module 4 that the 
transfer of notes 11 is ready to proceed (Step 924). Alternatively, if it is another Teller money module 5 that 
is making the deposit, it is the To Teller application 34 that issues the acknowledgement to the Teller 
money module 5 (Step 926). 

40 In either case, the acknowledgement is encrypted and transmitted using the procedure outlined in Steps 
2-8, whereby it is received by a To Teller application 34 of a depositing money module (Step 928). 

Referring back to Figure 35, once the deposit request is completed, the notes 11 are transferred from 
the Teller money module B 5 to the Teller money module C 5 using Steps 750-770, Figs. 39, 39A detailed 
above for transferring notes. Accordingly, To Bank C 47 posts the proper accounting transactions (see 

45 Figure 13, Step 2) to reflect this transfer of notes 11 (Step 908). In Teller money module C 5, the To Teller 
application 34 acknowledges the deposit by sending a message back to the To Teller B 34 application 
(Steps 910-912), using Steps 2-8. Naturally, the To Bank B 47 will now post its accounting transactions to 
reflect the withdrawal request it has made to Teller money module C 5 (Step 914; see also Fig. 13, Step 
3). 

so After all electronic notes 11 have been removed from the Transaction money module 4 and the proper 
accounts have been posted, a withdrawal is requested of a total amount that includes both the amount 
originally requested to be withdrawn from the subscriber's bank account and the amount that was removed 
from the Transaction money module 4 to be replaced with updated electronic notes 11. 

The withdrawal request is performed between Teller money module B 5 and Teller money module C 5 

55 using the process Steps 700-724, Figs. 30, 30A, described above. Teller money module C 5 transacts with 
Money Generator module 6 to withdraw new electronic money and in doing so it establishes a session 
between the two modules using the process Steps 190-258, Figs. 34, 34A-C. 
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■ rt t 0 c 11 w reauested by the Teller money module C 5 from the Money Generator 
The electrons notes ; 11 are requested by ^ ^ ^ ^ ^ 

Steps 750-770. . . R _ nW 2 pach m0 nev module must commit to the 

To finalize ^the . money modu.e A 4 

transact.on .t has just had with the corr .^PO na '"9 * 41 and thereafte r Teller money module B 

module 6, using the same process Steps 690 - 698. 
Deposit To An Issuing Bank 

Referring tc Figure 42 in combination with Figure 43, an example of a deposit to an Issuing Bank : 1 wiN 
now beTescribed I detail. To start the transaction, a deposit set up must be done wh.ch uses the process 

^n^T^ 2^1* of Figure 43. the subscriber decides to deposit some money to a bank. After 
In Step 398 at the top or ngu • d , 4 (following Steps 10-42. Figs. 31 - 

S^"^«XT«iS£i » 2. - m— con« M ^ <o support, 

deposit request (Step 404). _ prompts the subscriber for a 

"""" t^e e o r 4im ^ 'nrnew ?^?.£S£ the SesSon Managed 31 informs the subscriber 
new amount (Step 410) and if no new amou subscriber enters a new amount. Step 412. the 

S££ r^rC^^^ SL S^S 39 application again checks for sufficient 

30 adequate funds with, the 

SKtC^TiTVS 2abSin 3 g 3 a session between the Transaction 
T2£^.^/5^^ "two money module, the deposit request steps outNned in 
^^^^ 

moSlTo 0d t U he TeLr T moL°y module B 5 (Step 408) using the Steps 750-770 described above for 
transferring electronic notes 11 b ^poTtf thfaccounting transactions for the notes deposited 

( Ste?418 nU S Rg T^XrlTJn" STe'l the ^Transaction application 49 checks to 
£e if he amount deposited is less than the total notes 11 that were stored ,n module A jjndthen 
ttanserS to the Teller money module 5 (Step 420). If the deposit is less than the total amount of 
SSred notes 11. updated notes 11 must be generated and sent back to the Transaction money modu.e 

45 4 ' When all the notes that are contained in the Transaction money module 4 are deposited, i.e the 
™JJS to be de^SSis not .ess than the total amount of electronic notes 11, the To Transact.on B 49 w... 
t^ JZS^TTrm^ money modu.e 4 (Step 428) using the Steps 2 -8 for ^send-ng 
^J^Sm^^ modu.es. The To Te.ler A 34 receives the acknowledgement Step 430) and 
wTatefme Steps 690 - 698 to commit the deposit transaction between the two money modules 

WheTthre^onic notes 11 removed exceed the desired deposit amount, new updated notes 11 must 
be Z^ZT-rrZSL money module 4. To perform this^e To Bank appl^on B 47 oUhe Te, er 
money modu.e B 5 If u s^P^teps 190- 

^nd^eqtests \2£^T£m the Money Generator module 6 in the amount that should be 
returned to the Transaction money module 4. by performing Steps 780 - 792. anatamMl to the Teller 

Tf,e electronic notes 11 are created by the Money Generator module 6 and transferred to We Te le 
monly modi B 5 using Steps 750-770. With the e.ectronic notes 11 in the possesion of the Te..er 
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m module B 5, they are transferred to the J l^nST^S^ by 

aL Transaction money module A 4 rece.ves the electron* notes ^ *m ^ 

Deposit To A Correspondent Bank 

Correspondent Bank 2. the deposit »< "P^"^'", deposit is iess then » «.l 

amoon, - notes 11 to '^*-J*^ 1 2?E? i B -J , 1 . , S; ft. L» W» - ™» —V 

the Transaction money module 4 (btep-vw;. u&my k 

module B 5 to Transaction money module A 4. application receives the acknowledgement 

On the Transaction money module 4 side, the T o T « ' er ^ ^ Te „ er money module B 5. The 
(Step 446) and uses Steps ^ 690 - 698 to comm. Tl» fln-U* ll» 
^KT^Si^ ,V - To P Ban, application 4, (Step 44S). See 
R9U A e s 1 isS il*SS:T*r money module B S and Te.ler money modu.e C S 
using Steps 190 - 258. h T „ er money mod ule C 5 by using 

pjr^ws? ™ ~ ™" , — *~ ,SKp - ~ a,so Fi9 ' 

-.Si app.ica.io™ 34 of Te.i.r ^•^^J^ < ?% am * notes 11 « nave 

(Step 460; see also Fig. 11. Step 3) and new -note. 11 from Teller money module B 5 

Accordinalv a withdrawal request following the process bteps or 

?52 money modu.e C.J ^s^ module 6, using the 

Teller money module C 5 must first establish a wssorr w.tn y c g from 

process Steps 190-258. The new electrons ^J^£^JX£U then transferred to the Teller 
the Money Generator module 6 following VJ 0 ™™^*™ J^een money modules, 
money modu.e C 5 using Steps 750 - 770 to ^^Z. C 5 requires that accounting 

This transfer of electronic notes 11 te ^ e n 4 5B; see also Fig. 1 1 , Step 3). 

transactions be posted by the To Bank ap pl.cat or , C 47 Step 462, F^ , Q g {o ^ 

From there, the notes 11 are transferred from the ssumg £ank s ^ ^ ^ ^ 

Correspondent Bank's 2 Titer ™^a« b ;B an t the Tra^ ^ ^ ^ ^ ^ 

I^hl^^^ 

^set^v^^ use process steps 690 ' 698 
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crih^r A 33 aoolication Alice directs her Transaction money module 4 to make a payment (Step 806 & 
ZT^e lo^es his Transaction money moduie 4 such that the To Subscriber B 33 application w.ll 
issue an entitlement to receive payment (Step 808 & 812). 

In Steps 814 & 816 the Session Managers 31 or both Alice's Transact.cn money module 4 and Bob s 
Transaction money module 4 established communications. From there a session ,s estabhshed. as 
described in Steps 1 90 - 258 above for transacting between any two money modules. 

Wth a session established. To Subscriber A 33 prompts the subscriber to enter the amount of payment 
that she desires to transfer (Step 818), which is displayed to the subscnber. 

AUce enters the amount that she wishes to transfer to Bob. Pay/Exchange appl.ca .on A 35 , rece.ve^ the 
amount entered (Fig. 36. Step 820). The amount entered by type (currency or credit) .s now compared by 
Note Di recto ry A 39 to the balance of the va.ue of the electronic money stored.in the J*"^™""" 
module 4 to see if there are sufficient funds available to permit the transacts to proceed (Stop .822). 

I? there are insufficient funds. To Subscriber A 33 sends the subscriber a not.ce that there are not 
sufficient funds to cover the transaction desired (Steps 824 - 826). and prompts the subscnber ag*n for ^a 
new amount of payment (step 827). If the subscriber prefers not to enter a new amount, th ^ abort 
transaction process Steps 500 - 524 are activated to terminate the commun.cat.ons l.nk between the two 
ZnsZn money modules 4. On the other hand, a newly entered amount will return the process to Step 
820 to check for sufficient funds again. 

Wh^n there are sufficient funds stored in Transaction money module A 4 to process the transfer, 
Pay/Exchange A 35 sends a message disclosing the amount of the transfer to Bob's Transaction money 
module 4 (Step 828). using the process disclosed in Steps 2 -8. See Fig. 36A. From there^ jo ^bscnber B 
33 prompts the owner to verify that the amount to be transferred w.ll be accepted by h.m (Step 830). Bob 
can then decide whether to accept or reject the amount to be transferred (Step 832). Tran „ rtion 
If Bob responds in the negative, then Pay/Exchange B 35 will send a message back to Transactor, 
money module A 4 using Steps 2-8. that the amount to be transferred is incorrect (Step 834); the process 
aaain returns to Step 826. Fig. 36. to prompt Alice for a new amount to be entered. 

When Bob responds in the affirmative in Step 832. Pay/ Exchange B 35 will send an acknowledgement 
to Transaction money module A 4 using Steps 2 - 8 (Step 835). Back in Transaction money module A 4 the 
message will be conveyed to Pay/Exchange A 35 to receive the acknowledgment sent by Transacts 
money module B 4 (Step 836). . 

With this acknowledgement received. Pay/Exchange A 35 will send the amount desired to be trans- 
ferred to the Honey Holder 38 (Step 838) so that the electronic notes 11 may be transferred us.ng Steps 
750 - 770 With the transfer completed, the two Transaction money modules 4 must commit to the transfer 
using Step 690-698 described above. The communication link between the two transaction modules may 
now be terminated. 

Subscriber to Subscriber Foreign Exchange 

Referrinq to Figure 46, the process flow for an exchange of foreign currencies between two Transaction 
money modules 4 will now be illustrated. In this example Alice (or a hypothetical corporation, denoted A 
in Fioures 46 - 46A) agrees to exchange dollars for pounds with Bob (or a hypothetical corporation, denoted 
"B" in Figures 46-46A). The exchange rate that they have agreed to will be a ratio of dollars to pounds 

^AlfcTbegins by signing on to her Transaction money module 4 (using Steps 10-42 described above) 
while Bob signs on to his Transaction money module 4 (using Steps 10-42). Thereafter, the To Subscnber 
33 applications of both Transaction money modules 4 prompt the respective users to select a type of 
transaction (Steps 302 - 303). In this example. Alice and Bob agree to exchange her dollars for h.s pounds. 

By requesting the foreign exchange transaction, Session Manager A 31 will establish a commun.cat.ons 
link with Session Manager B 31 (Steps 306. 307) so that a session may be established between the two 
money modules using Steps 190-258. Alice is then prompted by To Subscriber A 33 for the amount of 
dollars she will sell, and the exchange rate that she will use in the transaction (Step 308). 

Pay/Exchange A 35 receives the input (Step 310) and Note Directory A 39 checks for suffic.ent funds 
by comparing the amount requested to the amount of value contained in the Transaction money module 4 
(Step 312). An insufficient funds condition will cause the To Subscriber A 33 to send an insuff.c.ent funds 
message to Alice and prompt the subscriber to select another amount of dollars and exchange rate (Steps 
318 - 320). When new selections are entered, the process flow returns to Step 312 and continues from 
there. If Alice does not select a new amount, the session is dissolved using abort transaction Steps 500 
524. 
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Whpn the funds are sufficient to meet the amount requested, the Pay/Exchange A 35 sends the amount 
of thTdollars and the proposed dollar/pound exchange rate (Step 316) to the To Subscriber application 33 
o Transact money module B 4 using the Steps 2-8. (See Figure 46A). At this point, To Subscnber B 33 
prompt Bob with the amount and rate proposed by Alice, to determine if the values are what Bob will 

5 a9re T e he° SS^STbI?'^^ the do..ar amount and the rate that is proposed by A.ice and if the 
•mo^S^Tnot agreed to by Bob, Pay/Exchange B 35 wil. send a message ind.cating that the 
vie 1 exchange rate is incorrect (Step 326), through the Steps of 2-8 for send.ng ; mes ge .To 
Subscriber A 33 prompts Alice for the dollar amount and exchange rate over aga,n (Step 327). Entry of new 

,o Values returns the process to Step 310 for continuation, see Fig. 46. whi.e the lack of new values entered 
pauses the abort transaction process of Steps 500 - 524 to be initiated. 

he amount and rate are agreed to by Bob, Pay/Exchange B 35 ; will calculate the ^v-J^Jt m 
oounds based on the rate provided (not shown), and then initiate the step of hav.ng Note Directory B 39 
chec to see thTt Transaction money module B 4 contains sufficient funds to futfiU the exchange (Step 

„ 323) When the funds in Transaction money module B 4 are insufficient to meet the exchange 
Pay/Exchange B 35 sends a message to Alice of insufficient funds (Step 325) us.ng Steps 2-8. The 

process flow returns to Step 327. r a 

Proceeding with the case in which sufficient funds do exist in Transaction money module B 4, 
Pay /Exchange B 35 will send an acknowledgement using Steps 2-8 to Transaction money module A 4 - 
Step 329) After receiving this acknowledgement, Pay/Exchange A 35 sends the amount of do are 
requested t 0 its corresponding Money Ho.der 38 application in Step 330. The do.lars are transferred from 
Alire to Bob via the Steps 750 - 770 described above for transferring notes 11. 

plv/lxchange B 35 receives the notes 11 and then transfers the amount of pounds to its Money Holder 
38 JX^X> 33D. From there, the electronic pounds are transferred to Alice using the transfer notes 
orocess described in Steps 750 - 770. To record this exchange. Transaction money module A 4 commits 
module B 4 by using process Steps 690 - 698 described above. With a i satisfy 
exchange, the communications link between the two Transaction money modules may now be terminated. 

Foreign Exchange At An Issuing Bank 

Turning attention now to Figure 48. if a subscriber were to exchange his/her dollars for pounds with an 
Issuina Bank 1 instead of with a subscriber, the following process is followed. 

Subscriber A sets up the foreign exchange transaction by signing on to his/her Transaction money 
module 4 see Rq 47Z) using Steps 10-42 described above. To Subscriber A 33 prompts the subscriber 
tofiiJSSSS ( S tep P 334). and in this examp.e, the subscriber f^^^^ 
exchange, and the amount of dollars the subscriber will exchange. It is ant.cipated that the choice of the 
bank to transact with may be an option offered to the subscriber (Step 336). 

The Note Directory A 39 checks for a sufficient balance to complete the request (Step 338)^ An 
insufficient balance permits the subscriber to again enter the amount he/she w.ll exchange Step 340- 
S whe eby Session Manager A 31 will terminate the transaction (Step 345) if no new amount ,. entered^ 
IS of a new amount returns the process to Step 338 to check for suffident funds 
request. When the funds are sufficient for the exchange request, a Network 25 s.gn-on us.ng Steps 50 

^fterTeTetork 25 sign-on. the Network 25 checks if a bank or financial institution has been 
selected (Step 346). If a bank or financial institution was not chosen earlier, To Teller A 34 must prompt the 
NeSonk Server 26, through Session Manager A 31, for a .ist of banks or financial .nst. utione Mh t w.H 
provide the exchange (Steps 348 - 350). The Network Server 26 sends the list (along with rates) to the 
subscriber through the To Teller A 34 and To Subscriber A 33 applications (Steps 352 - 356). 

After prompting (Step 357, Fig. 47A). the subscriber chooses a bank or financial mst.tut.on or ends tte 
transaction (Step 359). When a bank or financial institution is chosen, a session .s estabhs hed wrfh the 
Teller money module 5 chosen using Steps 190-258 described above. Atter a sess.on ,s estabhshed, To 
Teller A 34 sends the amount of dollars to be exchanged for pounds (Step 360) us.ng Steps 2-8 for 
encrypting and transmitting a message. 

To ensure that the subscriber still wants to proceed with the exchange, To Transact-on B 49 sends the 
current exchange rate to the subscriber using process Steps 2-8 (Step 362). At this pom , To Subscriber A 
33 prompts the subscriber with the bank's exchange rate and if the subscriber does not w.sh to proceed, 
the transaction is aborted by following Steps 500-524 (Steps 364-366). If the transact™ ,s to proceed 
the dollars are transferred from Transaction money module A 4 to Teller money module B 5 using Steps 
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750 n™Xl^" e £ once the set up of the foreign exchange transaction is accomplished the proper 
account AlSns are posted (Step 368; a.so illustrated in Bgure 15. ^ ^f^T^Z 
have iust been transferred. A session is established between Teller money module B 5 and a Money 
Generator module 6 via Steps 190-258. Teller money module B 5 requests the proper pound notes 11 
fhrouTh process Steps 780 - 792. The notes 11 are returned from the Money Generator module 6 to the 
Teller money module B 5 using Steps 750 - 770. 

This latter transfer of notes 11 requires a corresponding updating of the accounts involve (Step 370 
see also Fiq 15 Step 2). The notes 11 are transferred to the Transaction money module A 4 through 
excess Steps 750 - 770 To complete the exchange, Transaction money module A .4 commits to Teller 
money modufe B 5 who subsequently commits to the Money Generator module 6 us.ng process Steps 
690 - 698. 

Foreign Exchange At A Correspondent Bank 

The foreign exchange with a Correspondent Bank 2 is described with the aid of Figure 49. Initially the 
foreign exchange transaction is set up by repeating process Steps 334-366. (Figs. 47 - 47A) and updating 
^ proper accounts (see Figure 16, Steps 1 -2) to reflect the notes 11 that have just been transferred from 
the subSriber's money module 4 to Teller money module B 5 (Step 372). Thereafter. Teller money module 
B 5 wSf esSblfsh a session with Teller money module C 5 at an Issuing Bank 1. by performs process 

Ste A Sdrawa. is requested by Teller money module B 5 to Teller money module C 5 using , process 
Steos 920-928 described above. To obtain the notes 11 for the request, Teller money module , C 5 must 
qS them from a Money Generator module 6. Accordingly, a session is established between the ^o money 
SduleT via Steps 190-258. and the notes 11 are requested following process Steps 780 - 792 outlined 

^The Money Generator module 6 will create the notes 11 requested and transfer them to Teller money 
module C 5 using process Steps 750 - 770. This is followed by a posting to the proper accounts in the 
Z^'s systems ^Step 374). see Figure 16, Step 3 for accounting transactions). The notes 11 are now 
SerrerfL Telle? money module C to Transaction money module A 4 via Teller money module B 5 
using for each transfer the process Steps 750 - 770. Finally, all the sessions must be ' comm'tted^ and 
Transaction money module A 4 commits to Teller money module B 5 who in turn comm.ts to Teller money 
modufe C 5 using Steps 690-698. Teller money module C 5 commits to the Honey Generator module 6 to 
complete the exchange of dollars for pounds. 

Updating Notes, Certificate 

As mentioned above, it is anticipated that the date of expiration of a note, used as a security measure 
may expire while it is stored in a Transaction money module 4. If this occurs, the holder of expired notes 11 
will not be able to transfer them to another Transaction money module 4, but the holder may depos.t them 
or exchange them for new notes 11 by transacting with a participating bank or financial .nsMutjon. 

Additionally if the certificate associated with a particular Transaction money module 4 expires, the 
subscriber must sign on the Network 25 to update the certificate in order to transact with another 
Transaction money module 4. The following is a description of the process flow for updating an exp.red 

45 certificate or expired notes 11. 

Beqinning at the top of Figure 50, a subscriber signs on to the Transaction money module 4 ^us.ng the 
SteDS 10-42 described above, and is prompted by To Subscriber A 33 to select a transaction (Step 570). 
After selecting the transaction for "updating" (Step 572), a sign -on to the Network 25 is performed using 
Steps 50-168. The sign -on to the Network 25 will perform the updating of the certificate, as described 

50 above with reference to Figure 33 - 33A. m—.«h. 
For updating the notes 11, the Session Manager A 31 sends the update notes request to the Network 
25 (Step 574); the Network Server 26 responds by sending the selected bank identif.er back to the 
Transaction money module 4 (Step 576). Now, a session may be established between the Transaction 
money module A 4 and the Teller money module B 5 of the bank selected, using Steps 190-258. 

Once the session is established, To Teller A 34 sends the request to update notes 11 (Step 578) using 
the message sending routine in Steps 2-8. To Transactor B 32 responds, F.g. 50A, with an acknowledge- 
ment (Step 580) sent using Steps 2-8. Transaction money module A 4 can now transfer the exp.red notes 
11 to Teller money module B 5 using Steps 750 - 770. Thereafter, the corresponding accounting (see 
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Hour. « Step 1) is pert^ in ,h. bent<s records (Step 582), ,nd . session is unshod between 

r^., . p . «- ~ — rsrifirsr us« — • — 

The request notes rout,™ of Keps 780 792 584; SM ng . 

sr s^^rJSiT. SIS SS- — « - P— — - • 

commits routines ere performed using Steps 690 - 69 ^sc,^ ^ ^ 
eyeT o !^S££1> -din, £ ,n«.n, _ 

be used by subscribers in the fane processes. It will be ' ™ ^ k Mr , k draKs couW 

ed.pted to other monetary "i^.^Il P=»— 

be provided by .nhenemo Ot «» J™*'"" » ^ , ded witn wrop „„e 

^.^^i - ^".o System o, - invention to provtd. corporate 

purposes only, and do not in any way limit the invention, which is defined only by the claims. 
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Claims 

An electronic monetary system for providing transactions utilizing electronic representations of currency 
backed by demand deposits in a bank comprising: 

means for Generating said electronic representations of currency, 

b eZZ^rZs7mr^ns and between said transacting means and said te„er means. 

An electronic monetary system for providing transactions utilizing electronic representations of credit 

authorizations comprising: 

means for generating said electronic representations of cred.t; 

other transacting means and between said transacting means and sa.d teller means. 

3 An electronic monetary system according to Cairn 1 or claim 2 further comprising a means for 
45 maintaining the security and integrity of said electronic monetary system. 

means, and said security means. 
*° 5. Ah Iconic monetary system eccordino .0 * . « daim 2 ^T^Z^^ 

currency or credit transferred by said transacting means to said teller means. 

W 6. An electronic monetary system according to claim 3 wherein ^ ZTa^rlZt^l - 
time limit on the transferability of said electronic representations of credrt and said electronic repre 
sentations of currency among said transacting means. 
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An electronic monetary system according to claim 3 wherein said generating means, said teller means 
and said t^nsTcting means each comprise an individual identifier, and said means tor mamta.n.ng the 
secumy of said e.ectronic monetary system further comprises a certification means for prov.dmg a 
unique certificate of said identilier of each o( said generating means, said teller means and sa.d 

transacting means. 

An electronic monetary system according to claim 7 wherein said certificate further comprises a time 
limit on its acceptability by said generating means, said teller means or other of said transacting 

means. 

An electronic monetary system according to claim 1 or claim 2 wherein said generating means further 
comprises a public key digital forming means for forming a digital signature on sa.d electronic 
representations of currency or said electronic representations of credit. 

75 10. An electronic monetary system according to claim 1 or claim 2 wherein said teller means further 
comprises a public key digital forming means for forming a digital signature on sa.d electronic 
representations of currency or said electronic representations of credit. 

11 An electronic monetary system according to claim 1 or claim 2 wherein said transacting means further 
* comprises a public key digital forming means for forming a digital signature on sa.d electronic 

representations of currency or said electronic representations of credit. 

12 An electronic monetary system according to claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit are undeniably acceptable as econom.c value. 

13 An electronic monetary system according to claim 1 or claim 2 wherein said electronic representations 
' of currency or said electronic representations of credit are commutable and transferrable in values less 

than or equal to their original economic value when generated. 

14. An electronic monetary system according to claim 13 wherein said electronic representation of credit is 
transferable only one time by said transacting means. 

15. An electronic monetary system according to claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit further comprise indicia of 

(1) whether said representation is a currency or a credit representation, 

(2) its said time limit of transferability, and 

(3) its economic value. 

16. An electronic monetary system according to claim 15 wherein said indicia further comprise indicia of 
40 (1) said certificates of said other transacting means, 

(2) said certificates of said teller means, and 

(3) said certificate of said generating means. 

17. An electronic monetary system according to claim 16 wherein said indicia further comprise indicia of 
45 (1) a digital signature of said generating means, 

(2) a digital signature of said teller means, and 

(3) a digital signatures of said other transacting means. 

18. An electronic monetary system according to claim 1 or claim 2 wherein said generating means, said 
teller means, and said transacting means are each comprised of a programmable processing device 
contained in a tamper -proof housing. 
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19 An electronic monetary system according to claim 18 wherein said generating means, said teller 
means, and said transacting means are configured to perform as a modular co- processor of a general 
55 purpose computer. 

20. An electronic monetary system according to claim 18 wherein each of said programmable processing 
devices further comprises a list of other offending programmable processing devices. 
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21 An electronic monetary system according to claim 1 or claim 2 further comprising a means for clearing 
£d !S of credit and currency issued by more than one bank. 

financial transaction. 

transacting means that are held at each of said different financial facilities. 

unauthorized access of said accounts. 

credit for a plurality of monetary units. 

26 An electronic monetary system according to claim 18 wherein each of said programmable Pressing 
26. An electronic mone y - y unauthorized persons, such coding being 

whose identity remains anonymous. 

27 A monetary system using electronic representations of money and including at least one financial 

" ^ZZ7^ZV^^ %^ZZS»*o*> representation ^ the 
form o^ mSine Readable digital objects containing data indicative of the monetary va.ue represented 

^^^^^^"^ facility and capabie of communicating with said 
subset procSoS for the deposit in said facility of representations stored in sa,d subscnber 
orace sors or the hdrawal or representations from said facility to said subscriber processors; 
P sS ^sZer processors also including communication and processing functus enabling 
exchange of said representations between subscriber processors. 

28. A system according to claim 27 in which said money representations are configured to be functionally 
equivalent to bank notes. 

29. A system according to claim 27 including a certification source enabling the processing of said 
representations to indicate their validity. 

30 A system according to claim 27 in which there are a plurality of said financial facilities and a clearing 
LiS for clearing Lsactions among said financial facilities and said subscnber processors. 

31 A system according to c.aim 27 in which said data stored in said subscriber processors includes data 
representations for ascertaining the status of said representations. 

32 A svstem according to claim 27 in which said electronic representations of money stored in said 
^ubscrfber ^ocesso's are rep.aced with updated representations during transactions with said fmanca. 

facility. 

33 A monetary system using electronic media to securely and reliably exchange economic value, said 
™"Z^«Z^Sn S of credit authorizations and e.ectronic representations of currency 

l ^rEX^S££e presentations of credit and said electronic representations of 
currency; 
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teller means coupled to said generating means for issuing, distributing, and accepting said 
electronic representations of aedit anc ^ qMc representations 0 f credit and 
cur ^ZZZZZ^^^ said 9 transacting means and said teller means. 

™ans to maintain the security and integrity of said monetary system. 

^™,Hinn to claim 34 wherein said security means further comprises a time limit 
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means 
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42 



* ~ Q ^nrHinn tn Haim 34 wherein said generating means, said teller means and said 
36. A moneta ry « system J ^^.flfler, said means for maintaining the security of 

* for providin9 a , unique certificate of said 

Sntifier o! each of said generating means, said teller means and said transacts means. 

37 A monetary system according to claim 36 wherein said certificate further comprises a time limit on its 
iTptS by said generating means, said teller means or other of sa,d transactmg means. 

^™,Hinn tn Haim 34 further comprising a networking means for providing a 

said security means. 

values less than or equal to their original economic value. 

A monetary system according to claim 40 wherein said electronic representation of credit is transfer- 
able only one time by said transacting means. 

a mnnetar v svstem accordinq to claim 33 wherein said generating means further comprises a public 
iL?o^or^^ a digital signature on said electronic representations of cred.t and 

currency. 

43. A monetary system according to claim 33 wherein said teller means further comprises a public key 
digrSng" means for forming a digital signature on said electronic represents of credrt and 

currency. 

44 A monetary system according to claim 33 wherein said transacting means further comprises a public 
to^SSw forming means for forming a digital signature on said electron* representations of cred,t and 

currency. 

45. A monetary system according to claim 41 wherein said electronic representations of credit and 

currency comprise indicia of 
so (1) whether said representation is a currency or a credit representation, 

(2) its said time limit of transferability, 

(3) its economic value, 

(4) said digital signature of said generating means, 

(5) said digital signatures of said teller means, 

55 (6) said digital signatures of other transacting means, 

(7) said certificates of other transacting means, 

(8) said certificates of said teller means, 

(9) said certificate of said generating means, and 
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(10) an identifier of said electronic representation of currency or credit. 

46. A monetary system according to claim 33 wherein said generating means, said teller means, and said 
transacting means are each comprised of a programmable processing device contained in a tamper - 

5 proof housing. 

47. A monetary system according to claim 46 wherein said generating means, said teller means, and said 
transacting means are configured to perform as a modular co- processor of a computer. 

w 48. A monetary system according to claim 33 further comprising a means for clearing said electronic 
representations of credit and currency issued by more than one bank. 

49. A method of using electronic representations of currency or electronic representations of credit 
provided by at least one financial facility having a means for generating said electronic representations, 

75 and a teller means for issuing and accepting said electronic representations and serving subscribers of 

said facility, comprising the steps of: 

(1) generating said electronic representations of currency backed by demand deposits or generating 
said electronic representations of credit authorizations; 

(2) issuing to said subscribers and accepting from said subscribers electronic representations of 
20 currency or credit, wherein the issuance and acceptance is performed by said teller means at said 

financial facility; and 

(3) providing said subscribers with a transacting means for accepting said issued electronic 
representations of currency or credit, and for transferring said electronic representations of currency 
or credit to both other subscribers having said transacting means, and to said teller means. 

25 

50. The method of claim 49 further comprising the step of digitally signing said electronic representations 
of currency or credit to provide authenticity and security from duplication or modification. 

51. The method of claim 50 further comprising the step of limiting the time period that said electronic 
30 representations of currency or credit may be transferred among said transacting means. 

52. The method of claim 51 further comprising the step of removing all of said electronic representations of 
currency stored in said transacting means whenever said transacting means transacts with said 
financial facility, the step of generating new electronic representations of currency having a renewed 

35 time limit on transferability, and the step of replacing said original electronic representations of currency 
in said transacting means with said new electronic representations of currency. 

53. The method of claim 51 further comprising the step of removing all non -transferred electronic 
representations of credit authorizations stored in said transacting means only whenever said transacting 

40 means transacts with the financial facility issuing said electronic representations of credit, the step of 
generating new electronic representations of credit having a renewed time limit on transferability, and 
the step of replacing said original electronic representations of credit in said transacting means with 
said new electronic representations of credit. 

45 54. The method of claim 49 further comprising the steps of clearing, and maintaining records of said 
electronic representations of currency or credit issued by said financial facilities. 

55. The method of claim 49 further comprising the step of providing an identifier unique to each of said 
generating means, said teller means and said transacting means. 

50 

56. The method of claim 55 further comprising the step of certifying for a limited period of time the validity 
of said identifier of each of said generating means, said teller means and said transacting means. 

57. The method of claim 56 further comprising the step of providing a list of any offending teller means, 
55 generating means, or transacting means to each of said generating means, said teller means and said 

transacting means. 
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58. The method of claim 49 further comprising the step of generating said electronic representations of 
credit and currency for a plurality of different monetary units. 

59 The method of claim 49 further comprising the step of providing an accounting structure at said 
financial facilities to monitor the distribution of said electronic representations of currency or cred.t, and 
each financial facility's obligation after any financial transaction. 

60 The method of claim 59 further comprising the step of storing in said transacting means separate lists 
for accounts associated with said subscriber at each of said financial facilities. 



61 



20 



25 



The method of claim 60 further comprising the step of digitally signing each of said list of bank 
accounts with the digital signature of the corresponding financial facility, to provide security from 
unauthorized access of said accounts. 

, 5 62. The method of claim 55 further comprising the step of maintaining records of transactions undertaken 
by said generating means, said teller means and said transacting means and storing sa.d records wrth.n 
each of said respective generating means, said teller means and said transacting means where.n said 
transaction record includes indicia of the date of transfer, the amount of transfer, an .dentafier o the 
financial facility issuing said electronic representations of currency or credit, and an identifier of the 
electronic representation of currency or credit transferred. 

6a The method of claim 62 further comprising the step of maintaining copies of said electronic repre- 
sentations of currency and credit issued at said financial facilities, and the step of updat.ng sa.d cop.es 
upon transacting with any of said transacting means. 

64 The method of claim 63 further comprising the step of reconciling said copies of electronic repre- 
' sentations of currency and credit with electronic representations of currency and cred.t that have been 
cleared in said financial facilities. 

30 65. The method of claim 64 further comprising the steps of: ' 

(1) storing records of individual transactions that have occurred among sa.d transacting means to a 

separate storage means, . , 

(2) submitting said records of individual transactions stored in said storage means to said financial 
facilities when said electronic representations of currency or credit are stored in a transacting means 

35 that becomes lost or stolen, and 

(3) comparing said records of individual transactions among said transacting means with records 
produced by said reconciliation of said electronic representations of currency and credit to deter- 
mine the true value of said electronic representations of currency and credit stored in satd 
transacting means that may be lost or stolen, for accurate replacement of said value lost. 

66. The method of claim 49 further comprising the step of providing a communication network, linking 
together said financial facilities and said transacting means. 
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FIG. 2 
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FIG. 5 
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FIG. 6 
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